<pre name="code" class="html">input(type="imfile" File="/usr/local/apache-tomcat-7.0.55_8082/logs/localhost_access_log.*.txt" Tag="wj-api-access01" Severity="info" Facility="local5") 10.252.142.174 - - [24/Sep/2016:10:26:21 +0800] "GET /api/validate/code/send?mobilePhone=18627975523&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.013 27.187.187.138 10.252.142.174 - - [23/Sep/2016:23:59:52 +0800] "GET /api/validate/code/send?mobilePhone=13534287357&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.017 1.1.1.1 jrhapt11:/usr/local/apache-tomcat-7.0.55_8082/logs> echo '10.252.142.174 - - [23/Sep/2016:23:59:52 +0800] "GET /api/validate/code/send?mobilePhone=13534287357&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.017 1.1.1.1'>>localhost_access_log.2016-09-23.txt jrhapt11:/usr/local/apache-tomcat-7.0.55_8082/logs> date Sat Sep 24 10:27:01 CST 2016 rsyslog 会读取变化的日志 就是通配的话 日志变化 就回去读,哪怕是旧的日志 10.252.142.174 - - [24/Sep/2016:10:26:21 +0800] "GET /api/validate/code/send?mobilePhone=18627975523&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.013 27.187.187.138 10.252.142.174 - - [23/Sep/2016:23:59:52 +0800] "GET /api/validate/code/send?mobilePhone=13534287357&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.017 1.1.1.1 jrhapt11:/usr/local/apache-tomcat-7.0.55_8082/logs> echo '10.252.142.174 - - [23/Sep/2016:23:59:52 +0800] "GET /api/validate/code/send?mobilePhone=13534287357&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.017 1.1.1.1'>>localhost_access_log.2016-09-23.txt jrhapt11:/usr/local/apache-tomcat-7.0.55_8082/logs> date Sat Sep 24 10:27:01 CST 2016 rsyslog 会读取变化的日志 就是通配的话 日志变化 就回去读,哪怕是旧的日志