$InputFilePersistStateInterval 1 Specifies how often the state file shall be written when processing the input file. The default value is 0, which means a new state file is only written when the monitored files is being closed (end of rsyslogd execution). Any other value n means that the state file is written every time n file lines have been processed. This setting can be used to guard against message duplication due to fatal errors (like power fail). Note that this setting affects imfile performance, especially when set to a low value. Frequently writing the state file is very time consuming. 应用发送端: uat-web02:/var/log/nginx# cat scan.log dadadatest uat-web02:/var/log/nginx# echo "dadadatest" >>scan.log You have new mail in /var/spool/mail/root uat-web02:/var/log/nginx# echo "1111111111111" >>scan.log uat-web02:/var/log/nginx# echo "2222222222222" >>scan.log uat-web02:/var/log/nginx# ps -ef | grep rsyslog root 23550 1 0 14:50 ? 00:00:00 /sbin/rsyslogd -i /var/run/syslogd.pid root 23576 22786 0 14:50 pts/1 00:00:00 grep rsyslog uat-web02:/var/log/nginx# kill -9 23550 uat-web02:/var/log/nginx# ps -ef | grep rsyslog root 23578 22786 0 14:50 pts/1 00:00:00 grep rsyslog uat-web02:/var/log/nginx# service rsyslog start Starting system logger: [ OK ] uat-web02:/var/log/nginx# cat scan.log dadadatest dadadatest 1111111111111 2222222222222 You have new mail in /var/spool/mail/root rsyslog 接收端: zjtest7-frontend:/data/scan# cat scan.2016-10-10 dadadatest 1111111111111 2222222222222 zjtest7-frontend:/data/scan# cat scan.2016-10-10 dadadatest 1111111111111 2222222222222 dadadatest dadadatest 1111111111111 2222222222222 看到当kill后,会重发 解决: input(type="imfile" File="/var/log/nginx/scan.log" Tag="uat-scan" Severity="info" PersistStateInterval="1" Facility="local5")