Aug 5 16:36:12 jrhwpt01 nginx-zjzc01: www.zjcap.cn 10.252.105.157 10.171.246.184 [05/Aug/2016:16:36:12 +0800] "GET /resources/js/toolbar.49fc367e.js?_v=${last.updated}&_=1470385747637 HTTP/1.1" - 200 1800 "https://www.zjcap.cn/" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" 0.001 -Aug 5 16:36:13 jrhwpt01 nginx-zjzc01: www.zjcap.cn 10.252.105.157 10.252.142.174 [05/Aug/2016:16:36:13 +0800] "GET /resources/images/home/login_after_summary_bg.6771b127.jpg HTTP/1.1" - 200 1115 "https://www.zjcap.cn/" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" 0.000 -Aug 5 16:36:37 jrhwpt01 nginx-zjzc01: www.zjcap.cn 10.252.105.157 10.171.246.184 [05/Aug/2016:16:36:37 +0800] "GET /resources/js/toolbar.49fc367e.js?_v=${last.updated}&_=1470385772954 HTTP/1.1" - 200 1800 "https://www.zjcap.cn/" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" 0.001 -^Cwww.zjcap.cn 10.252.105.157 10.171.246.184 [05/Aug/2016:16:36:37 +0800] "GET /resources/js/toolbar.49fc367e.js?_v=${last.updated}&_=1470385772954 HTTP/1.1" - 200 1800 "https://www.zjcap.cn/" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" 0.001 -nginx 配置:user nginx;worker_processes 1;syslog local5 nginx-zjzc01;然后rsyslog 根据nginx-zjzc01 去匹配 写到不同的日志目录