<pre name="code" class="html">[root@dr-mysql01 zjzc_log]# grep '24/Sep/2016' zj-api-access01.2016-09-25 | wc -l

0

[root@dr-mysql01 zjzc_log]#

[root@dr-mysql01 zjzc_log]#

[root@dr-mysql01 zjzc_log]# grep '24/Sep/2016' zj-api-access02.2016-09-25 | wc -l

1

[root@dr-mysql01 zjzc_log]# grep '24/Sep/2016' zj-api-access02.2016-09-25

 10.171.246.184 - - [24/Sep/2016:23:59:52 +0800] "GET /api/validate/code/send?mobilePhone=15264905555&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.015 117.95.71.190

 重启 api01 的rsyslog服务；

 [root@dr-mysql01 zjzc_log]# grep '23/Sep/2016' zj-api-access01.2016-09-25 | wc -l

28155

[root@dr-mysql01 zjzc_log]# grep '24/Sep/2016' zj-api-access01.2016-09-25 | wc -l

20276

 [root@dr-mysql01 zjzc_log]# grep '24/Sep/2016' zj-api-access02.2016-09-25 | wc -l

1

You have mail in /var/spool/mail/root

[root@dr-mysql01 zjzc_log]# grep '24/Sep/2016' zj-api-access02.2016-09-25 | wc -l

2081

[root@dr-mysql01 zjzc_log]# grep '24/Sep/2016' zj-api-access02.2016-09-25 | wc -l

6441

[root@dr-mysql01 zjzc_log]# grep '24/Sep/2016' zj-api-access02.2016-09-25 | wc -l

10658

rsyslog 一重启就会开始同步之前所有通配的日志文件,重启rsyslog又会重头开始读日志