syslog转存nginx日志的简单配法

命令

单独启动一个独立的rsyslog进程

rsyslogd -i /root/tong1/rsyslogd/pid -f /root/tong1/rsyslogd/rsyslogd.conf

配置文件

module(load="imuxsock")
input(type="imuxsock" Socket="/root/tong1/rsyslogd/error" CreatePath="on")
input(type="imuxsock" Socket="/root/tong1/rsyslogd/http-access" CreatePath="on")
input(type="imuxsock" Socket="/root/tong1/rsyslogd/stream-access" CreatePath="on")

local0.* /export/Logs/nginx/error.log
local1.* /export/Logs/nginx/http-access.log
local3.* /export/Logs/nginx/stream-access.log

nginx配置

access_log syslog:server=unix:/root/tong1/rsyslogd/http-access,facility=local1 http_format;

性能分析

多个nginx worker写入同一个unix socket，本质上还是一写多，一样是有锁了。