網上很多rsyslog日誌蒐集伺服器的教程都很亂！自己來寫一篇。
資源有限，在一臺機器上做實驗。

centos7預設已經安裝：

[root@QFQLDl155405 2018-07-31]#  rpm -qa | grep rsys
rsyslog-8.24.0-12.el7.x86_64

配置主配置檔案/etc/rsyslog.conf

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
 

$ModLoad imtcp  #開啟tcp
$InputTCPServerRun 514  #埠
$FileCreateMode 0644    #檔案建立許可權
$DirCreateMode 0755     #目錄許可權
$Umask 0022
$EscapeControlCharactersOnReceive off  #字符集調整
$template LogFormat,"%msg%\n"          #定義模板
$template DayPerProgram_AccessLogs,"/opt/logs/%programname:1:320%/%fromhost-ip%/%$year%-%$month
 
%-%$day%/%programname%.%$year%-%$month%-%$day%-%$hour%.log" #定義日誌位置模板
if ($programname contains 'nginx' ) then -?DayPerProgram_AccessLogs;LogFormat #設定觸發條件
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
$OmitLocalLogging on
$IMJournalStateFile
 
 imjournal.state
*.info;mail.none;authpriv.none;cron.none;local3.none;local4.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 :omusrmsg:*
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log

配置客戶端檔案：/etc/rsyslog.d/nginx.conf

$ModLoad imfile

$InputFileName /alidata/nginx/logs/default.log   #日誌路徑
$InputFileTag nginx_skynet                      #日誌標籤
$InputFileStateFile nginx_log                   
$InputFileFacility local4
$InputFileSeverity notice
$InputFilePersistStateInterval 1
$InputRunFileMonitor



$InputFilePollInterval 1
if ($programname contains 'nginx')  then @@127.0.0.1:514    #@@是tcp，@是UDP

啟動：systemctl start rsyslog
你會發現nginx的日誌同步到了：/opt/logs/nginx_skynet/2018-07-31/nginx_skynet.2018-07-31-09.log