rsyslogd在重新启动时发送新的信息或整个日志文件

我试图在Debian机器上使用rsyslog将日志数据发送到外部服务器。

我感兴趣的日志文件大约有10GB的历史数据。

当我开始configurationrsyslog时，我的印象是要开始把所有新的日志条目发送到服务器，但是目标服务器的维护者告诉我发送了超过10GB的数据。 我重新启动rsyslogd几次。

我想知道，如果默认情况下，它从一开始就发送所有日志而不是新的？

• 如何parsings3日志？
• 什么是一个好的sendmail日志分析器？
• 明智的日志政策和工具
• 获取Subversion Apache模块以使用CustomLog
• 使日志检查不仅仅是给我发电子邮件的反应

这是我的configuration文件的样子

$ModLoad imfile $InputFilePollInterval 10 $PrivDropToGroup adm $WorkDirectory /var/spool/rsyslog #################### # Nginx Access Log # #################### # Input for Nginx Access Log $InputFileName /var/log/nginx/myapp.access.log $InputFileTag nginx-access $InputFileStateFile stat-nginx-access #this must be unique for each file being polled $InputFileSeverity info $InputFilePersistStateInterval 20000 $InputRunFileMonitor # Add a tag for file events $template NginxAccessFormat,"<%pri%>%protocol-version% %timestamp:::date-rfc3339% %hostname% %app-name% %procid% %msgid% [SecretKey@41058 tag=\"myapp-nginx-access\"] %msg%\n" # Send to Loggly then discard if $programname == 'nginx-access' then @@server.loggly.com:514;NginxAccessFormat if $programname == 'nginx-access' then ~ ###################### # Nginx Access Error # ###################### # Input for Nginx Error Log #$InputFileName /var/log/nginx/myapp.error.log #$InputFileTag nginx-error #$InputFileStateFile stat-nginx-error #this must be unique for each file being polled #$InputFileSeverity info #$InputFilePersistStateInterval 20000 #$InputRunFileMonitor # Add a tag for file events #$template NginxErrorFormat,"<%pri%>%protocol-version% %timestamp:::date-rfc3339% %hostname% %app-name% %procid% %msgid% [SecretKey@41058 tag=\"myapp-nginx-error\"] %msg%\n" # Send to Loggly then discard #if $programname == 'nginx-error' then @@server.loggly.com:514;NginxErrorFormat #if $programname == 'nginx-error' then ~ ############# # PHP Error # ############# # Input for PHP Error Log #$InputFileName /var/log/hhvm/error.log #$InputFileTag php-error #$InputFileStateFile stat-php-error #this must be unique for each file being polled #$InputFileSeverity info #$InputFilePersistStateInterval 20000 #$InputRunFileMonitor # Add a tag for file events #$template PhpErrorFormat,"<%pri%>%protocol-version% %timestamp:::date-rfc3339% %hostname% %app-name% %procid% %msgid% [SecretKey@41058 tag=\"myapp-hhvm-error\"] %msg%\n" # Send to Loggly then discard #if $programname == 'php-error' then @@server.loggly.com:514;PhpErrorFormat #if $programname == 'php-error' then ~ 

这里是rsyslogd的版本信息

 rsyslogd -v rsyslogd 8.4.2, compiled with: FEATURE_REGEXP: Yes GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes memory allocator: system default Runtime Instrumentation (slow code): No uuid support: Yes Number of Bits in RainerScript integers: 64 See http://www.rsyslog.com for more information.