freshStartTail 第一次启动时 抛弃旧的日志

freshStartTail [on/off] (requires v8.18.0+)
Default: off

This is used to tell rsyslog to seek to the end/tail of input files (discard old logs)**at its first start(freshStart)** and process only new log messages.

When deploy rsyslog to a large number of servers, we may only care about new log messages generated after the deployment. set freshstartTail to on will discard old logs. Otherwise, there may be vast useless message burst on the remote central log receiver

这是告诉 rsyslog来寻求 输入日志的尾部,抛弃旧的日志 在第一次启动的时候,只处理最新的日志

当部署rsyslog 到一大量的服务器的时候,我们只关心新的日志,

设置 freshstartTail 为on 会忽略老的日志。

$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
module(load="imfile" PollingInterval="5")
$ModLoad imtcp
$InputTCPServerRun 514
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
*.info;mail.none;authpriv.none;cron.none;local5.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log
$InputFilePersistStateInterval 1
input(type="imfile"
File="/var/log/nginx/access.log"
Tag="zjzc-frontend01-access"
PersistStateInterval="1"
reopenOnTruncate="on"
freshStartTail="on"
Severity="info"
Facility="local5")

input(type="imfile"
File="/var/log/nginx/error.log"
Tag="zjzc-frontend01-error"
Severity="info"
PersistStateInterval="1"
reopenOnTruncate="on"
freshStartTail="on"
Facility="local5")
local5.* @@115.236.160.82:9514