rsyslog 只读取变化的日志-优快云博客

本文介绍了一个rsyslog的配置示例，通过指定路径和文件名模式来实时监控并读取Apache Tomcat应用服务器产生的日志文件。此外，还展示了如何通过向已存在的日志文件追加记录来触发rsyslog读取更新。

<pre name="code" class="html">input(type="imfile"
File="/usr/local/apache-tomcat-7.0.55_8082/logs/localhost_access_log.*.txt"
Tag="wj-api-access01"
Severity="info"
Facility="local5")


 10.252.142.174 - - [24/Sep/2016:10:26:21 +0800] "GET /api/validate/code/send?mobilePhone=18627975523&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.013 27.187.187.138
 10.252.142.174 - - [23/Sep/2016:23:59:52 +0800] "GET /api/validate/code/send?mobilePhone=13534287357&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.017 1.1.1.1
 
 
 jrhapt11:/usr/local/apache-tomcat-7.0.55_8082/logs> echo '10.252.142.174 - - [23/Sep/2016:23:59:52 +0800] "GET /api/validate/code/send?mobilePhone=13534287357&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.017 1.1.1.1'>>localhost_access_log.2016-09-23.txt 
jrhapt11:/usr/local/apache-tomcat-7.0.55_8082/logs> date
Sat Sep 24 10:27:01 CST 2016




rsyslog 会读取变化的日志


就是通配的话 日志变化 就回去读,哪怕是旧的日志

10.252.142.174 - - [24/Sep/2016:10:26:21 +0800] "GET /api/validate/code/send?mobilePhone=18627975523&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.013 27.187.187.138
 10.252.142.174 - - [23/Sep/2016:23:59:52 +0800] "GET /api/validate/code/send?mobilePhone=13534287357&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.017 1.1.1.1
 
 
 jrhapt11:/usr/local/apache-tomcat-7.0.55_8082/logs> echo '10.252.142.174 - - [23/Sep/2016:23:59:52 +0800] "GET /api/validate/code/send?mobilePhone=13534287357&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.017 1.1.1.1'>>localhost_access_log.2016-09-23.txt 
jrhapt11:/usr/local/apache-tomcat-7.0.55_8082/logs> date
Sat Sep 24 10:27:01 CST 2016


rsyslog 会读取变化的日志

就是通配的话 日志变化 就回去读,哪怕是旧的日志

转载于:https://www.cnblogs.com/zhaoyangjian724/p/6199168.html