$InputFilePersistStateInterval 1

Specifies how often the state file shall be written when processing the input file. The default value is 0, which means a new state file is only written when the monitored files is being closed 

(end of rsyslogd execution). Any other value n means that the state file is written every time n file lines have been processed. This setting can be used to guard against message duplication due to 

fatal errors (like power fail). Note that this setting affects imfile performance, especially when set to a low value. Frequently writing the state file is very time consuming.

应用发送端:

uat-web02:/var/log/nginx# cat scan.log

dadadatest

uat-web02:/var/log/nginx# echo "dadadatest" >>scan.log

You have new mail in /var/spool/mail/root

uat-web02:/var/log/nginx# echo "1111111111111" >>scan.log

uat-web02:/var/log/nginx# echo "2222222222222" >>scan.log

uat-web02:/var/log/nginx# ps -ef | grep rsyslog

root     23550     1  0 14:50 ?        00:00:00 /sbin/rsyslogd -i /var/run/syslogd.pid

root     23576 22786  0 14:50 pts/1    00:00:00 grep rsyslog

uat-web02:/var/log/nginx# kill -9 23550

uat-web02:/var/log/nginx# ps -ef | grep rsyslog

root     23578 22786  0 14:50 pts/1    00:00:00 grep rsyslog

uat-web02:/var/log/nginx# service rsyslog start

Starting system logger:                                    [  OK  ]

uat-web02:/var/log/nginx# cat scan.log

dadadatest

dadadatest

1111111111111

2222222222222

You have new mail in /var/spool/mail/root

rsyslog 接收端:

zjtest7-frontend:/data/scan# cat scan.2016-10-10

 dadadatest

 1111111111111

 2222222222222

zjtest7-frontend:/data/scan# cat scan.2016-10-10

 dadadatest

 1111111111111

 2222222222222

 dadadatest

 dadadatest

 1111111111111

 2222222222222

看到当kill后,会重发

解决:

input(type="imfile"

File="/var/log/nginx/scan.log"

Tag="uat-scan"

Severity="info"

PersistStateInterval="1"

Facility="local5")