rsyslog 日志格式和输出

日志格式:

$EscapeControlCharactersOnReceive off      #关闭rsyslog默认转译ASCII<32的所有怪异字符，包括换行符等
$template nginx-zjzc01,"/rsyslog/data/nginx/zjzc/nginx_access01_log.%$year%-%$month%-%$day%"       #定义TC：日志存放路径
$template nginx-zjzc02,"/rsyslog/data/nginx/zjzc/nginx_access02_log.%$year%-%$month%-%$day%"            #定义TCBeta：日志存放路径
$template tocFormat,"%msg%\n"                  #定义toc日志format
:rawmsg,contains,"nginx-zjzc01:"  -?nginx-zjzc01;tocFormat                 #接受TC：日志，并应用tocFormat格式
:rawmsg,contains,"nginx-zjzc02:"  -?nginx-zjzc02;tocFormat        #接受TCBeta：日志，并应用tocFormat格式







输出:

 www.zjcap.cn 10.168.29.17 10.171.246.184 [11/Aug/2016:12:02:20 +0800] "GET /wechat/images/index/anchor.27a8911e.png HTTP/1.1" - 304 0 "https://www.zjcap.cn/wechat/home.html?

useragent=ios_h5_zjcap&apiver=2&WKWebView=1" "ios_h5_zjcap" 0.001 -
 www.zjcap.cn 10.168.29.17 10.171.246.184 [11/Aug/2016:12:02:20 +0800] "GET /resources/images/icon/coupon.b9243e75.png HTTP/1.1" - 200 715 "https://www.zjcap.cn/resources/css/index.css?06212016" 

"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" 0.001 -





日志格式:
#
$EscapeControlCharactersOnReceive off      #关闭rsyslog默认转译ASCII<32的所有怪异字符，包括换行符等
$template nginx-zjzc01,"/rsyslog/data/nginx/zjzc/nginx_access01_log.%$year%-%$month%-%$day%"       #定义TC：日志存放路径
$template nginx-zjzc02,"/rsyslog/data/nginx/zjzc/nginx_access02_log.%$year%-%$month%-%$day%"            #定义TCBeta：日志存放路径
$template tocFormat,"'%syslogtag%','%msg%'\n"                  #定义toc日志format
:rawmsg,contains,"nginx-zjzc01:"  -?nginx-zjzc01;tocFormat                 #接受TC：日志，并应用tocFormat格式
:rawmsg,contains,"nginx-zjzc02:"  -?nginx-zjzc02;tocFormat        #接受TCBeta：日志，并应用tocFormat格式


输出:
Aug 11 12:12:42 jrhwpt01 nginx-zjzc01: 120.26.44.206:8001 120.26.44.206 121.40.156.144 [11/Aug/2016:12:12:42 +0800] "GET / HTTP/1.1" - 200 30873 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) 

libcurl/7.19.7 NSS/3.15.3 zlib/1.2.3 libidn/1.18 libssh2/1.4.2" 0.000 -

转载于:https://www.cnblogs.com/zhaoyangjian724/p/6199389.html