nginx 配置: user nginx; worker_processes 1; syslog local5 nginx-zjzc01; rsyslog 服务器收到的消息: -rw-r--r-- 1 root root 190 Aug 10 16:08 aa.log zjtest7-frontend:/tmp# cat aa.log Aug 10 16:10:02 jrhwpt01 nginx-zjzc01: www.zjcap.cn 10.252.105.157 10.171.246.184 [10/Aug/2016:16:10:02 +0800] "GET / HTTP/1.1" - 200 30873 "-" "LWP::Simple/5.827 libwww-perl/5.833" 0.005 - 测试: nginx 端: 120.26.44.206:8001 120.26.44.206 120.55.118.6 [10/Aug/2016:16:21:13 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.001 - rsyslog 服务器端: zjtest7-frontend:/rsyslog/data/nginx/zjzc# grep curl nginx_access0*2016-08-10 nginx_access01_log.2016-08-10: 120.26.44.206:8001 120.26.44.206 115.236.160.82 [10/Aug/2016:16:11:31 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.004 - nginx_access01_log.2016-08-10: 120.26.44.206:8001 120.26.44.206 120.55.118.6 [10/Aug/2016:16:21:13 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.001 - 此时停止rsyslog服务器: nginx 端: 120.26.44.206:8001 120.26.44.206 121.40.248.168 [10/Aug/2016:16:22:45 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.15.3 zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.001 - ^C 开启rsyslog rsyslog端: zjtest7-frontend:/rsyslog/data/nginx/zjzc# grep curl nginx_access0*2016-08-10 nginx_access01_log.2016-08-10: 120.26.44.206:8001 120.26.44.206 115.236.160.82 [10/Aug/2016:16:11:31 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.004 - nginx_access01_log.2016-08-10: 120.26.44.206:8001 120.26.44.206 120.55.118.6 [10/Aug/2016:16:21:13 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 N/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.001 - zjtest7-frontend:/tmp# cat aa.log | grep curl Aug 10 16:11:31 jrhwpt01 nginx-zjzc01: 120.26.44.206:8001 120.26.44.206 115.236.160.82 [10/Aug/2016:16:11:31 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.004 - Aug 10 16:21:13 jrhwpt01 nginx-zjzc01: 120.26.44.206:8001 120.26.44.206 120.55.118.6 [10/Aug/2016:16:21:13 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.19.1 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.001 -