23【線上日誌分析】之改造CDH的HDFS的NN,DN程式，日誌輸出為json格式

1.登入nn機器,進入最新序號的namenode配置資料夾,檢視當前的nn的log4j配置
[root@sht-sgmhadoopnn-01 ~]# cd /var/run/cloudera-scm-agent/process/
[root@sht-sgmhadoopnn-01 process]# ls -lrt
.......
.......
.......
drwxr-x--x 3 hdfs   hdfs   380 Mar 30 20:40 372-hdfs-FAILOVERCONTROLLER
drwxr-x--x 3 hdfs   hdfs   500 Mar 30 20:40 370-hdfs-NAMENODE
drwxr-x--x 3 hdfs   hdfs   360 Mar 30 20:40 422-hdfs-FAILOVERCONTROLLER
drwxr-x--x 3 hdfs   hdfs   480 Mar 30 20:40 420-hdfs-NAMENODE
drwxr-x--x 3 yarn   hadoop 520 Mar 30 20:40 383-yarn-RESOURCEMANAGER
drwxr-x--x 3 mapred hadoop 400 Mar 30 20:40 379-yarn-JOBHISTORY
drwxr-x--x 3 mapred hadoop 380 Mar 30 20:40 425-yarn-JOBHISTORY
drwxr-x--x 3 yarn   hadoop 500 Mar 30 20:40 428-yarn-RESOURCEMANAGER
drwxr-x--x 3 root   root   180 Mar 31 15:53 359-cluster-host-inspector
[root@sht-sgmhadoopnn-01 process]# cd 420-hdfs-NAMENODE
[root@sht-sgmhadoopnn-01 420-hdfs-NAMENODE]# cat log4j.properties
log.threshold=INFO
main.logger=RFA
hadoop.root.logger=${log.threshold},${main.logger}
log4j.appender.EventCounter=org.apache.hadoop.log.metrics.EventCounter
log4j.rootLogger=${hadoop.root.logger},EventCounter,EventCatcher
log.dir=/var/log/hadoop-hdfs
log.file=hadoop-cmf-hdfs-NAMENODE-sht-sgmhadoopnn-01.log.out
max.log.file.size=200MB
max.log.file.backup.index=10
log4j.appender.RFA=org.apache.log4j.RollingFileAppender
log4j.appender.RFA.File=${log.dir}/${log.file}
log4j.appender.RFA.layout=org.apache.log4j.PatternLayout
log4j.appender.RFA.layout.ConversionPattern=%d{ISO8601} %p %c: %m%n
log4j.appender.RFA.MaxFileSize=${max.log.file.size}
log4j.appender.RFA.MaxBackupIndex=${max.log.file.backup.index}
log4j.appender.console=org.apache.log4j.ConsoleAppender
log4j.appender.console.target=System.err
log4j.appender.console.layout=org.apache.log4j.PatternLayout
log4j.appender.console.layout.ConversionPattern=%d{yy/MM/dd HH:mm:ss} %p %c{2}: %m%n
........
........

2.仔細分析,log4j.appender.RFA.layout.ConversionPattern 這個引數應該是控制nn程式的日誌

3.開啟CDH,進HDFS的Configuration介面,搜尋"log"關鍵詞,

3.1 找到"NameNode Logging Advanced Configuration Snippet (Safety Valve)",配置
log4j.appender.RFA.layout.ConversionPattern = {"time":"%d{yyyy-MM-dd HH:mm:ss,SSS}","logtype":"%p","loginfo":"%c:%m"}%n

3.2 找到"DataNode Logging Advanced Configuration Snippet (Safety Valve)",也配置
log4j.appender.RFA.layout.ConversionPattern = {"time":"%d{yyyy-MM-dd HH:mm:ss,SSS}","logtype":"%p","loginfo":"%c:%m"}%n

3.3 單擊儲存 
3.4 單擊Stale Configuration:Restart needed 

3.5 Restart Stale Services

3.6 Review Changes,勾選Re-deploy client configuration ,Restart Now

4.檢查nn,dn程式的日誌輸出是否為json格式
4.1 檢查新增的引數是否生效
[root@sht-sgmhadoopnn-01 420-hdfs-NAMENODE]# cd ../
[root@sht-sgmhadoopnn-01 process]# ls -lrt
.......
.......
.......
drwxr-x--x 3 hdfs   hdfs   380 Mar 31 20:32 422-hdfs-FAILOVERCONTROLLER
drwxr-x--x 3 hdfs   hdfs   360 Mar 31 20:32 439-hdfs-FAILOVERCONTROLLER
drwxr-x--x 3 hdfs   hdfs   480 Mar 31 20:32 437-hdfs-NAMENODE
drwxr-x--x 3 mapred hadoop 400 Mar 31 20:32 425-yarn-JOBHISTORY
drwxr-x--x 3 yarn   hadoop 520 Mar 31 20:32 428-yarn-RESOURCEMANAGER
drwxr-x--x 3 mapred hadoop 380 Mar 31 20:32 442-yarn-JOBHISTORY
drwxr-x--x 3 yarn   hadoop 500 Mar 31 20:32 445-yarn-RESOURCEMANAGER
[root@sht-sgmhadoopnn-01 process]# cd 437-hdfs-NAMENODE
[root@sht-sgmhadoopnn-01 437-hdfs-NAMENODE]# cat log4j.properties |grep log4j.appender.RFA.layout.ConversionPattern
log4j.appender.RFA.layout.ConversionPattern={"time":"%d{yyyy-MM-dd HH:mm:ss,SSS}","logtype":"%p","loginfo":"%c:%m"}%n
[root@sht-sgmhadoopnn-01 437-hdfs-NAMENODE]#

4.2 檢查log即可
[root@sht-sgmhadoopnn-01 437-hdfs-NAMENODE]# tail -f /var/log/hadoop-hdfs/hadoop-cmf-hdfs-NAMENODE-sht-sgmhadoopnn-01.log.out
{"time":"2017-03-31 20:40:38,588","logtype":"INFO","loginfo":"org.apache.hadoop.hdfs.server.namenode.FSImage:Reading expecting start txid #142520"}
{"time":"2017-03-31 20:40:38,588","logtype":"INFO","loginfo":"org.apache.hadoop.hdfs.server.namenode.FSImage:Start loading edits file , "}
{"time":"2017-03-31 20:40:38,588","logtype":"INFO","loginfo":"org.apache.hadoop.hdfs.server.namenode.EditLogInputStream:Fast-forwarding stream '%3A1863012361%3A0%3Acluster8, to transaction ID 142520"}
{"time":"2017-03-31 20:40:38,588","logtype":"INFO","loginfo":"org.apache.hadoop.hdfs.server.namenode.EditLogInputStream:Fast-forwarding stream '%3A1863012361%3A0%3Acluster8' to transaction ID 142520"}

5. 不足,當出現exception換行時,就會整個資訊只有第一行為json格式,剩餘行為普通輸出,那麼整個一條資訊就不是完整的json的
解決方法:
5.1 改造 log4j-xxxx.jar --成本太大
5.2 在flume-ng端的exec source改造,我們採取第二種
5.3 google搜尋 log4j json,發現和我一樣需求的人很多,有現成的GitHub專案等等