rsyslog 传输日志

nginx 服务器:

front-end:/usr/local/nginx/logs# cat /etc/rsyslog.conf | grep -v "^$" | grep -v "^#"
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
module(load="imfile"PollingInterval="5")
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none;local5.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log
input(type="imfile"
File="/usr/local/nginx/logs/access.log"
Tag="nginx-test"
Severity="info"
Facility="local5")
local5.*@192.168.32.76:514

rsyslog 日志服务器:

local5.*                                               /rsyslog/data/nginx/test/nginx-acccess.log

这种方式不好的地方,当nginx 服务器日志被>后,就不会发送日志到rsyslog服务器里。