23【在线日志分析】之改造CDH的HDFS的NN,DN进程，日志输出为json格式
1.登录nn机器,进入最新序号的namenode配置文件夹,查看当前的nn的log4j配置 [root@sht-sgmhadoopnn-01 ~]# cd /var/run/cloudera-scm-agent/process/ [root@sht-sgmhadoopnn-01 process]# ls -lrt ....... ....... ....... drwxr-x--x 3 hdfs hdfs 380 Mar 30 20:40 372-hdfs-FAILOVERCONTROLLER drwxr-x--x 3 hdfs hdfs 500 Mar 30 20:40 370-hdfs-NAMENODE drwxr-x--x 3 hdfs hdfs 360 Mar 30 20:40 422-hdfs-FAILOVERCONTROLLER drwxr-x--x 3 hdfs hdfs 480 Mar 30 20:40 420-hdfs-NAMENODE drwxr-x--x 3 yarn hadoop 520 Mar 30 20:40 383-yarn-RESOURCEMANAGER drwxr-x--x 3 mapred hadoop 400 Mar 30 20:40 379-yarn-JOBHISTORY drwxr-x--x 3 mapred hadoop 380 Mar 30 20:40 425-yarn-JOBHISTORY drwxr-x--x 3 yarn hadoop 500 Mar 30 20:40 428-yarn-RESOURCEMANAGER drwxr-x--x 3 root root 180 Mar 31 15:53 359-cluster-host-inspector [root@sht-sgmhadoopnn-01 process]# cd 420-hdfs-NAMENODE[root@sht-sgmhadoopnn-01 420-hdfs-NAMENODE]# cat log4j.properties log.threshold=INFO main.logger=RFA hadoop.root.logger=${log.threshold},${main.logger} log4j.appender.EventCounter=org.apache.hadoop.log.metrics.EventCounter log4j.rootLogger=${hadoop.root.logger},EventCounter,EventCatcher log.dir=/var/log/hadoop-hdfs log.file=hadoop-cmf-hdfs-NAMENODE-sht-sgmhadoopnn-01.log.out max.log.file.size=200MB max.log.file.backup.index=10 log4j.appender.RFA=org.apache.log4j.RollingFileAppender log4j.appender.RFA.File=${log.dir}/${log.file} log4j.appender.RFA.layout=org.apache.log4j.PatternLayout log4j.appender.RFA.layout.ConversionPattern=%d{ISO8601} %p %c: %m%n log4j.appender.RFA.MaxFileSize=${max.log.file.size} log4j.appender.RFA.MaxBackupIndex=${max.log.file.backup.index} log4j.appender.console=org.apache.log4j.ConsoleAppender log4j.appender.console.target=System.err log4j.appender.console.layout=org.apache.log4j.PatternLayout log4j.appender.console.layout.ConversionPattern=%d{yy/MM/dd HH:mm:ss} %p %c{2}: %m%n ........ ........ 2.仔细分析,log4j.appender.RFA.layout.ConversionPattern 这个参数应该是控制nn进程的日志 3.打开CDH,进HDFS的Configuration界面,搜索"log"关键词, 3.1 找到"NameNode Logging Advanced Configuration Snippet (Safety Valve)",配置 log4j.appender.RFA.layout.ConversionPattern = {"time":"%d{yyyy-MM-dd HH:mm:ss,SSS}","logtype":"%p","loginfo":"%c:%m"}%n 3.2 找到"DataNode Logging Advanced Configuration Snippet (Safety Valve)",也配置 log4j.appender.RFA.layout.ConversionPattern = {"time":"%d{yyyy-MM-dd HH:mm:ss,SSS}","logtype":"%p","loginfo":"%c:%m"}%n 3.3 单击保存3.4 单击Stale Configuration:Restart needed 3.5 Restart Stale Services 3.6 Review Changes,勾选Re-deploy client configuration ,Restart Now 4.检查nn,dn进程的日志输出是否为json格式 4.1 检查新增的参数是否生效 [root@sht-sgmhadoopnn-01 420-hdfs-NAMENODE]# cd ../ [root@sht-sgmhadoopnn-01 process]# ls -lrt ....... ....... ....... drwxr-x--x 3 hdfs hdfs 380 Mar 31 20:32 422-hdfs-FAILOVERCONTROLLER drwxr-x--x 3 hdfs hdfs 360 Mar 31 20:32 439-hdfs-FAILOVERCONTROLLER drwxr-x--x 3 hdfs hdfs 480 Mar 31 20:32 437-hdfs-NAMENODE drwxr-x--x 3 mapred hadoop 400 Mar 31 20:32 425-yarn-JOBHISTORY drwxr-x--x 3 yarn hadoop 520 Mar 31 20:32 428-yarn-RESOURCEMANAGER drwxr-x--x 3 mapred hadoop 380 Mar 31 20:32 442-yarn-JOBHISTORY drwxr-x--x 3 yarn hadoop 500 Mar 31 20:32 445-yarn-RESOURCEMANAGER [root@sht-sgmhadoopnn-01 process]# cd 437-hdfs-NAMENODE [root@sht-sgmhadoopnn-01 437-hdfs-NAMENODE]# cat log4j.properties |grep log4j.appender.RFA.layout.ConversionPattern log4j.appender.RFA.layout.ConversionPattern={"time":"%d{yyyy-MM-dd HH:mm:ss,SSS}","logtype":"%p","loginfo":"%c:%m"}%n [root@sht-sgmhadoopnn-01 437-hdfs-NAMENODE]# 4.2 检查log即可 [root@sht-sgmhadoopnn-01 437-hdfs-NAMENODE]# tail -f /var/log/hadoop-hdfs/hadoop-cmf-hdfs-NAMENODE-sht-sgmhadoopnn-01.log.out {"time":"2017-03-31 20:40:38,588","logtype":"INFO","loginfo":"org.apache.hadoop.hdfs.server.namenode.FSImage:Reading org.apache.hadoop.hdfs.server.namenode.RedundantEditLogInputStream@5c588660 expecting start txid #142520"} {"time":"2017-03-31 20:40:38,588","logtype":"INFO","loginfo":"org.apache.hadoop.hdfs.server.namenode.FSImage:Start loading edits file http://sht-sgmhadoopdn-02:8480/getJournal?jid=nameservice1&segmentTxId=142520&storageInfo=-60%3A1863012361%3A0%3Acluster8, http://sht-sgmhadoopdn-01:8480/getJournal?jid=nameservice1&segmentTxId=142520&storageInfo=-60%3A1863012361%3A0%3Acluster8"} {"time":"2017-03-31 20:40:38,588","logtype":"INFO","loginfo":"org.apache.hadoop.hdfs.server.namenode.EditLogInputStream:Fast-forwarding stream 'http://sht-sgmhadoopdn-02:8480/getJournal?jid=nameservice1&segmentTxId=142520&storageInfo=-60%3A1863012361%3A0%3Acluster8, http://sht-sgmhadoopdn-01:8480/getJournal?jid=nameservice1&segmentTxId=142520&storageInfo=-60%3A1863012361%3A0%3Acluster8' to transaction ID 142520"} {"time":"2017-03-31 20:40:38,588","logtype":"INFO","loginfo":"org.apache.hadoop.hdfs.server.namenode.EditLogInputStream:Fast-forwarding stream 'http://sht-sgmhadoopdn-02:8480/getJournal?jid=nameservice1&segmentTxId=142520&storageInfo=-60%3A1863012361%3A0%3Acluster8' to transaction ID 142520"} 5. 不足,当出现exception换行时,就会整个信息只有第一行为json格式,剩余行为普通输出,那么整个一条信息就不是完整的json的解决方法: 5.1 改造 log4j-xxxx.jar --成本太大 5.2 在flume-ng端的exec source改造,我们采取第二种 5.3 google搜索 log4j json,发现和我一样需求的人很多,有现成的GitHub项目等等
)
