nginx 通过rsyslog发日志 rsyslog服务器挂掉 日志丢失问题

nginx 配置:
user  nginx;
worker_processes  1;
syslog local5 nginx-zjzc01;


rsyslog 服务器收到的消息:

-rw-r--r-- 1 root  root  190 Aug 10 16:08 aa.log
zjtest7-frontend:/tmp# cat aa.log 
Aug 10 16:10:02 jrhwpt01 nginx-zjzc01: www.zjcap.cn 10.252.105.157 10.171.246.184 [10/Aug/2016:16:10:02 +0800] "GET / HTTP/1.1" - 200 30873 "-" "LWP::Simple/5.827 libwww-perl/5.833" 0.005 -



测试:

nginx 端:

120.26.44.206:8001 120.26.44.206 120.55.118.6 [10/Aug/2016:16:21:13 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.19.1 Basic ECC zlib/1.2.3 

libidn/1.18 libssh2/1.4.2" 0.001 -






rsyslog 服务器端:

zjtest7-frontend:/rsyslog/data/nginx/zjzc# grep curl nginx_access0*2016-08-10
nginx_access01_log.2016-08-10: 120.26.44.206:8001 120.26.44.206 115.236.160.82 [10/Aug/2016:16:11:31 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 

NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.004 -


nginx_access01_log.2016-08-10: 120.26.44.206:8001 120.26.44.206 120.55.118.6 [10/Aug/2016:16:21:13 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 

NSS/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.001 -


此时停止rsyslog服务器:

nginx 端:
120.26.44.206:8001 120.26.44.206 121.40.248.168 [10/Aug/2016:16:22:45 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.15.3 zlib/1.2.3 libidn/1.18 

libssh2/1.4.2" 0.001 -
^C


开启rsyslog



rsyslog端:

zjtest7-frontend:/rsyslog/data/nginx/zjzc# grep curl nginx_access0*2016-08-10
nginx_access01_log.2016-08-10: 120.26.44.206:8001 120.26.44.206 115.236.160.82 [10/Aug/2016:16:11:31 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 

NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.004 -

nginx_access01_log.2016-08-10: 120.26.44.206:8001 120.26.44.206 120.55.118.6 [10/Aug/2016:16:21:13 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 
N/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.001 -




zjtest7-frontend:/tmp# cat aa.log  | grep curl
Aug 10 16:11:31 jrhwpt01 nginx-zjzc01: 120.26.44.206:8001 120.26.44.206 115.236.160.82 [10/Aug/2016:16:11:31 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) 

libcurl/7.19.7 NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.004 -

Aug 10 16:21:13 jrhwpt01 nginx-zjzc01: 120.26.44.206:8001 120.26.44.206 120.55.118.6 [10/Aug/2016:16:21:13 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) 

libcurl/7.19.7 NSS/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.001 -