利用開源日志收集軟體fluentd收集日志到HDFS檔案系統中

說明：本來研究開源日志的系統是flume，後來發現配置比較麻煩，網上搜尋到fluentd也是開源的日志收集系統，配置簡單多了，性能不錯，是以就改研究這個東東了！官方首頁，大家可以看看：fluentd.org，支援300+的plugins，應該是不錯的！

fluentd是通過hadoop中的webHDFS與HDFS進行通信的，是以在配置fluentd時，一定要保證webHDFS能正常通信，和通過webHDFS寫資料到hdfs中！

原理圖如下：

<a href="http://s3.51cto.com/wyfs02/M00/54/5B/wKiom1SAB_PCQmAmAADSV4dSD3E785.jpg" target="_blank"></a>

安裝環境大緻說明：

1）fluentd和hadoop中的namenode要安裝到一台實體機器上；

2）os版本：rhel 5.7 64位

3）hadoop版本：1.2.1

4）jdk1.7.0_67

5）ruby版本：ruby 2.1.2p95 

1.安裝前的準備工作，安裝ruby，因為fluentd是ruby開發的：

yum install openssl-devel zlib-devel gcc gcc-c++ make autoconf readline-devel curl-devel expat-devel gettext-devel

解除安裝系統自帶ruby版本：

yum erase ruby ruby-libs ruby-mode ruby-rdoc ruby-irb ruby-ri ruby-docs

通過源碼安裝ruby：

然後解壓包，編譯，把ruby安裝到目錄 /usr/local/ruby即可，然後設定profile環境變量。

測試ruby：

[root@node1 install]# ruby -v

ruby 2.1.2p95 (2014-05-08 revision 45877) [x86_64-linux]

出現以上字段，代表ruby安裝成功。

2.fluentd安裝：

fluentd有源碼安裝，gem安裝或者rpm方式安裝三種方式；

本文采用rpm的安裝方式官方文檔已經幫我們寫好了腳本,直接執行就行了：

安裝成功以後，啟動腳本是：/etc/init.d/td-agent start

配置檔案路徑是：/etc/td-agent/

[root@node1 install]# cd /etc/td-agent/

You have new mail in /var/spool/mail/root

[root@node1 td-agent]# pwd

/etc/td-agent

[root@node1 td-agent]# ls

logrotate.d  plugin  prelink.conf.d  td-agent.conf  

3.利用gem安裝fluentd插件fluent-plugin-webhdfs

1）由于國内防火牆block了ruby源，請更換gem的源：

[root@node1 bin]# td-agent-gem source --remove https://ruby.taobao.org/

https://ruby.taobao.org/ removed from sources

[root@node1 bin]# td-agent-gem source -a https://ruby.taobao.org/      

https://ruby.taobao.org/ added to sources

2）安裝插件：

td-agent-gem  install fluent-plugin-webhdfs

檢視gem的安裝清單：

td-agent-gem list

*** LOCAL GEMS ***

bigdecimal (1.2.4)

bundler (1.7.7)

cool.io (1.2.4)

fluent-mixin-config-placeholders (0.3.0)

fluent-mixin-plaintextformatter (0.2.6)

fluent-plugin-webhdfs (0.4.1)

fluentd (0.12.0.pre.2)

http_parser.rb (0.6.0)

io-console (0.4.2)

json (1.8.1)

ltsv (0.1.0)

minitest (4.7.5)

msgpack (0.5.9)

psych (2.0.5)

rake (10.1.0)

rdoc (4.1.0)

sigdump (0.2.2)

string-scrub (0.0.5)

test-unit (2.1.2.0)

thread_safe (0.3.4)

tzinfo (1.2.2)

tzinfo-data (1.2014.10)

uuidtools (2.1.5)

webhdfs (0.6.0)

yajl-ruby (1.2.1)

4）配置flunetd，加載fluent-plugin-webhdfs 子產品；

加入以下字段：

vim /etc/td-agent/td-agent.conf

1

2

3

4

5

6

7

<code>&lt;match hdfs.*.*&gt;</code>

<code>  </code><code>type</code> <code>webhdfs</code>

<code>  </code><code>host node1.</code><code>test</code><code>.com</code>

<code>  </code><code>port 50070</code>

<code>  </code><code>path </code><code>/log/</code><code>%Y%m%d_%H</code><code>/access</code><code>.log.${</code><code>hostname</code><code>}</code>

<code>  </code><code>flush_interval 1s</code>

<code>&lt;</code><code>/match</code><code>&gt;</code>

重新開機td-agent服務；

5）設定hdfs相關配置：

建立log目錄

 hadoop fs -mkdir /log

賦予log目錄權限為777，如果不賦予，資料寫不進去，官方文檔沒有說明，測試了好久才發現！

hadoop fs -chmod 777 /log

6）再次重新開機td-agent服務，開始測試，測試指令如下：

這時就發現hadoop裡面檔案有變化了！

<a href="http://s3.51cto.com/wyfs02/M00/54/5B/wKioL1SAGl3hvxMKAAEJZGry3HE760.jpg" target="_blank"></a>

安裝配置過程中的報錯：

1）

2014-12-03 15:56:12 +0800 [warn]: failed to communicate hdfs cluster, path: /log/20141203_15/access.log.node1.test.com

2014-12-03 15:56:12 +0800 [warn]: temporarily failed to flush the buffer. next_retry=2014-12-03 15:56:28 +0800 error_class="WebHDFS::ClientError" error="{\"RemoteException\":{\"exception\":\"IllegalArgumentException\",\"javaClassName\":\"java.lang.IllegalArgumentException\",\"message\":\"n must be positive\"}}" instance=23456251808160

  2014-12-03 15:56:12 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/webhdfs-0.5.5/lib/webhdfs/client_v1.rb:313:in `request'

  2014-12-03 15:56:12 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/webhdfs-0.5.5/lib/webhdfs/client_v1.rb:231:in `operate_requests'

  2014-12-03 15:56:12 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/webhdfs-0.5.5/lib/webhdfs/client_v1.rb:45:in `create'

  2014-12-03 15:56:12 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluent-plugin-webhdfs-0.3.1/lib/fluent/plugin/out_webhdfs.rb:189:in `rescue in send_data'

  2014-12-03 15:56:12 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluent-plugin-webhdfs-0.3.1/lib/fluent/plugin/out_webhdfs.rb:186:in `send_data'

  2014-12-03 15:56:12 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluent-plugin-webhdfs-0.3.1/lib/fluent/plugin/out_webhdfs.rb:205:in `write'

  2014-12-03 15:56:12 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluentd-0.10.55/lib/fluent/buffer.rb:296:in `write_chunk'

  2014-12-03 15:56:12 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluentd-0.10.55/lib/fluent/buffer.rb:276:in `pop'

  2014-12-03 15:56:12 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluentd-0.10.55/lib/fluent/output.rb:311:in `try_flush'

  2014-12-03 15:56:12 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluentd-0.10.55/lib/fluent/output.rb:132:in `run'

出現以上情況，是你的hdfs檔案系統有問題，不能寫資料等等，請單獨測試hdfs的是否運作正常！

2）

2014-12-04 14:44:55 +0800 [warn]: failed to communicate hdfs cluster, path: /log/20141204_14/access.log.node1.test.com

2014-12-04 14:44:55 +0800 [warn]: temporarily failed to flush the buffer. next_retry=2014-12-04 14:45:30 +0800 error_class="WebHDFS::IOError" error="{\"RemoteException\":{\"exception\":\"AccessControlException\",\"javaClassName\":\"org.apache.hadoop.security.AccessControlException\",\"message\":\"org.apache.hadoop.security.AccessControlException: Permission denied: user=webuser, access=WRITE, inode=\\\"\\\":hadoop:supergroup:rwxr-xr-x\"}}" instance=23456251808060

  2014-12-04 14:44:55 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/webhdfs-0.5.5/lib/webhdfs/client_v1.rb:317:in `request'

  2014-12-04 14:44:55 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/webhdfs-0.5.5/lib/webhdfs/client_v1.rb:242:in `operate_requests'

  2014-12-04 14:44:55 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/webhdfs-0.5.5/lib/webhdfs/client_v1.rb:45:in `create'

  2014-12-04 14:44:55 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluent-plugin-webhdfs-0.3.1/lib/fluent/plugin/out_webhdfs.rb:189:in `rescue in send_data'

  2014-12-04 14:44:55 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluent-plugin-webhdfs-0.3.1/lib/fluent/plugin/out_webhdfs.rb:186:in `send_data'

  2014-12-04 14:44:55 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluent-plugin-webhdfs-0.3.1/lib/fluent/plugin/out_webhdfs.rb:205:in `write'

  2014-12-04 14:44:55 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluentd-0.10.55/lib/fluent/buffer.rb:296:in `write_chunk'

  2014-12-04 14:44:55 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluentd-0.10.55/lib/fluent/buffer.rb:276:in `pop'

  2014-12-04 14:44:55 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluentd-0.10.55/lib/fluent/output.rb:311:in `try_flush'

  2014-12-04 14:44:55 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluentd-0.10.55/lib/fluent/output.rb:132:in `run'

2014-12-04 14:45:31 +0800 [warn]: failed to communicate hdfs cluster, path: /log/20141204_14/access.log.node1.test.com

2014-12-04 14:45:31 +0800 [warn]: temporarily failed to flush the buffer. next_retry=2014-12-04 14:46:26 +0800 error_class="WebHDFS::IOError" error="{\"RemoteException\":{\"exception\":\"AccessControlException\",\"javaClassName\":\"org.apache.hadoop.security.AccessControlException\",\"message\":\"org.apache.hadoop.security.AccessControlException: Permission denied: user=webuser, access=WRITE, inode=\\\"\\\":hadoop:supergroup:rwxr-xr-x\"}}" instance=23456251808060

  2014-12-04 14:45:31 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/webhdfs-0.5.5/lib/webhdfs/client_v1.rb:317:in `request'

  2014-12-04 14:45:31 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/webhdfs-0.5.5/lib/webhdfs/client_v1.rb:242:in `operate_requests'

  2014-12-04 14:45:31 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/webhdfs-0.5.5/lib/webhdfs/client_v1.rb:45:in `create'

  2014-12-04 14:45:31 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluent-plugin-webhdfs-0.3.1/lib/fluent/plugin/out_webhdfs.rb:189:in `rescue in send_data'

  2014-12-04 14:45:31 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluent-plugin-webhdfs-0.3.1/lib/fluent/plugin/out_webhdfs.rb:186:in `send_data'

  2014-12-04 14:45:31 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluent-plugin-webhdfs-0.3.1/lib/fluent/plugin/out_webhdfs.rb:205:in `write'

  2014-12-04 14:45:31 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluentd-0.10.55/lib/fluent/buffer.rb:296:in `write_chunk'

  2014-12-04 14:45:31 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluentd-0.10.55/lib/fluent/buffer.rb:276:in `pop'

  2014-12-04 14:45:31 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluentd-0.10.55/lib/fluent/output.rb:311:in `try_flush'

  2014-12-04 14:45:31 +0800 [warn]: /usr/lib64/fluent/ruby/lib/ruby/gems/1.9.1/gems/fluentd-0.10.55/lib/fluent/output.rb:132:in `run'

出現以上情況，一般是你的hdfs沒有設定好權限，把存放日志的hdfs目錄chmod 777，就可以了！

如果日志寫入hdfs正常，日志顯示的是：2014-12-04 14:48:40 +0800 [warn]: retry succeeded. instance=23456251808060

本文轉自 shine_forever 51CTO部落格，原文連結:http://blog.51cto.com/shineforever/1586347