flume1.6.0安装

1、下载apache-flume-1.6.0-bin.tar.gz
解压tar -zxvf apache-flume-1.6.0-bin.tar.gz
2、配置环境变量：vi /etc/profile
export?FLUME_HOME=/A/soft/flume-1.6.0??
export?FLUME_CONF_DIR=$FLUME_HOME/conf??
export?PATH=$PATH:$FLUME_HOME/bin??
3、修改flume1.6.0/conf下的flume-env.sh文件
JAVA_HOME=/A/soft/jdk1.7.0_79
4、创建文件夹syslogudp，写配置文件（目的：获取远程服务器的syslog日志）
a1.sources=r1
a1.channels=c1 c2 c3 c4
a1.sinks=k1 k2 k3 k4
a1.sources.r1.type=syslogudp
#远程服务器ip
a1.sources.r1.bind=x.x.x.x
a1.sources.r1.port=514
a1.sources.r1.interceptors=i1 
a1.sources.r1.interceptors.i1.type=regex_extractor
a1.sources.r1.interceptors.i1.regex=(admin|flag|Portinfo|Collapsar)
a1.sources.r1.interceptors.i1.serializers=ser1
a1.sources.r1.interceptors.i1.serializers.ser1.name=Adm
a1.sources.r1.selector.type=multiplexing
a1.sources.r1.selector.header=Adm
a1.sources.r1.selector.mapping.admin=c1
a1.sources.r1.selector.mapping.flag=c2
a1.sources.r1.selector.mapping.Portinfo=c3
a1.sources.r1.selector.mapping.Collapsar=c4
#a1.sources.r1.selector.default=c2
a1.channels.c1.type=memory
a1.channels.c1.capacity=100000
a1.channels.c1.transactionCapacity=100000
a1.channels.c1.keep-alive=60
a1.channels.c2.type=memory
a1.channels.c2.capacity=100000
a1.channels.c2.transactionCapacity=100000
a1.channels.c2.keep-alive=60
a1.channels.c3.type=memory
a1.channels.c3.capacity=100000
a1.channels.c3.transactionCapacity=100000
a1.channels.c3.keep-alive=60
a1.channels.c4.type=memory
a1.channels.c4.capacity=100000
a1.channels.c4.transactionCapacity=100000
a1.channels.c4.keep-alive=60
#r1sink
a1.sinks.k1.type=hdfs
a1.sinks.k1.channel=c1
#a1.sinks.k1.hdfs.path=hdfs://59.67.152.31:8020/inLogs/%Y/%m/%d/%H/%M
a1.sinks.k1.hdfs.path=hdfs://59.67.152.31:8020/flumeAttack_eventLogs/%Y/%m/%d/%H
a1.sinks.k1.hdfs.useLocalTimeStamp=true
a1.sinks.k1.hdfs.writeFormat = Text
a1.sinks.k1.hdfs.fileType = DataStream
a1.sinks.k1.hdfs.round=true
a1.sinks.k1.hdfs.roundValue=30
a1.sinks.k1.hdfs.rollInterval = 30
a1.sinks.k1.hdfs.rollSize = 0
a1.sinks.k1.hdfs.rollCount = 0
#r2sink
a1.sinks.k2.type=hdfs
a1.sinks.k2.channel=c2
a1.sinks.k2.hdfs.path=hdfs://59.67.152.31:8020/flumeAttackLogs/%Y/%m/%d/%H
a1.sinks.k2.hdfs.useLocalTimeStamp=true
a1.sinks.k2.hdfs.writeFormat = Text
a1.sinks.k2.hdfs.fileType = DataStream
a1.sinks.k2.hdfs.round=true
a1.sinks.k2.hdfs.roundValue=30
a1.sinks.k2.hdfs.rollInterval = 30
a1.sinks.k2.hdfs.rollSize = 0
a1.sinks.k2.hdfs.rollCount = 0
#r3sink
a1.sinks.k3.type=hdfs
a1.sinks.k3.channel=c3
a1.sinks.k3.hdfs.path=hdfs://59.67.152.31:8020/flumePortInfoLogs/%Y/%m/%d/%H
a1.sinks.k3.hdfs.useLocalTimeStamp=true
a1.sinks.k3.hdfs.writeFormat = Text
a1.sinks.k3.hdfs.fileType = DataStream
a1.sinks.k3.hdfs.round=true
a1.sinks.k3.hdfs.roundValue=30
a1.sinks.k3.hdfs.rollInterval = 30
a1.sinks.k3.hdfs.rollSize = 0
a1.sinks.k3.hdfs.rollCount = 0
#r4sink
a1.sinks.k4.type=hdfs
a1.sinks.k4.channel=c4
a1.sinks.k4.hdfs.path=hdfs://59.67.152.31:8020/flumeCPUMEMInfoLogs/%Y/%m/%d/%H
a1.sinks.k4.hdfs.useLocalTimeStamp=true
a1.sinks.k4.hdfs.writeFormat = Text
a1.sinks.k4.hdfs.fileType = DataStream
a1.sinks.k4.hdfs.round=true
a1.sinks.k4.hdfs.roundValue=30
a1.sinks.k4.hdfs.rollInterval = 30
a1.sinks.k4.hdfs.rollSize = 0
a1.sinks.k4.hdfs.rollCount = 0
a1.sources.r1.channels=c1 c2 c3 c4
5、运行flume（前提是hadoop已正常启动）
bin/flume-ng agent -c . -f /A/soft/apache-flume-1.6.0-bin/conf/syslogudp -n a1 -Dflume.root.logger=INFO,console