网上很多rsyslog日志搜集服务器的教程都很乱！自己来写一篇。
资源有限，在一台机器上做实验。
centos7默认已经安装：
[root@QFQLDl155405 2018-07-31]# rpm -qa | grep rsysrsyslog-8.24.0-12.el7.x86_64配置主配置文件/etc/rsyslog.conf
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)$ModLoad imjournal # provides access to the systemd journal$ModLoad imtcp #开启tcp$InputTCPServerRun 514 #端口$FileCreateMode 0644 #文件创建权限$DirCreateMode 0755 #目录权限$Umask 0022$EscapeControlCharactersOnReceive off #字符集调整$template LogFormat,"%msg%n" #定义模板$template DayPerProgram_AccessLogs,"/opt/logs/%programname:1:320%/%fromhost-ip%/%$year%-%$month%-%$day%/%programname%.%$year%-%$month%-%$day%-%$hour%.log" #定义日志位置模板if ($programname contains 'nginx' ) then -?DayPerProgram_AccessLogs;LogFormat #设置触发条件$WorkDirectory /var/lib/rsyslog$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat$IncludeConfig /etc/rsyslog.d/*.conf$OmitLocalLogging on$IMJournalStateFile imjournal.state*.info;mail.none;authpriv.none;cron.none;local3.none;local4.none /var/log/messagesauthpriv.* /var/log/securemail.* -/var/log/maillogcron.* /var/log/cron*.emerg :omusrmsg:*uucp,news.crit /var/log/spoolerlocal7.* /var/log/boot.log配置客户端文件：/etc/rsyslog.d/nginx.conf
$ModLoad imfile$InputFileName /alidata/nginx/logs/default.log #日志路径$InputFileTag nginx_skynet #日志标签$InputFileStateFile nginx_log $InputFileFacility local4$InputFileSeverity notice$InputFilePersistStateInterval 1$InputRunFileMonitor$InputFilePollInterval 1if ($programname contains 'nginx') then @@127.0.0.1:514 #@@是tcp，@是UDP启动：systemctl start rsyslog
你会发现nginx的日志同步到了：/opt/logs/nginx_skynet/2018-07-31/nginx_skynet.2018-07-31-09.log