架構圖：

技術選型：
exec source + memory channel + avro sink
avro source + memory channel + logger sink

1)server A 資料收集端

在cd $FLUME_HOME/conf
vim exec-memory-avro.conf

#exec-memory-avro.conf內容
# a1可以看做是flume服務的名稱，每個flume都由sources、channels和sinks三部分組成
# sources可以看做是資料來源頭、channels是中間轉存的渠道、sinks是資料後面的去向
exec-memory-avro.sources = exec-source
exec-memory-avro.sinks = avro-sink
exec-memory-avro.channels = memory-channel

# 配置Source
exec-memory-avro.sources.exec-source.type = exec
exec-memory-avro.sources.exec-source.command = tail -F /data/a.txt
exec-memory-avro.sources.exec-source.shell = /bin/sh -c
#exec-memory-avro.sources.exec-source.command = for i in /path/*.txt; do cat $i; done

# 配置Channel
exec-memory-avro.channels.memory-channel.type = memory

# 配置Sinks
exec-memory-avro.sinks.avro-sink.type = avro
exec-memory-avro.sinks.avro-sink.hostname = 0.0.0.0
exec-memory-avro.sinks.avro-sink.port = 44444

# 繫結
exec-memory-avro.sources.exec-source.channels = memory-channel
exec-memory-avro.sinks.avro-sink.channel = memory-channel
 

2)server B 資料儲存端

在cd $FLUME_HOME/conf
vim avro-memory-logger.conf

# avro-memory-logger.conf內容
# a1可以看做是flume服務的名稱，每個flume都由sources、channels和sinks三部分組成
# sources可以看做是資料來源頭、channels是中間轉存的渠道、sinks是資料後面的去向
avro-memory-logger.sources = avro-source
avro-memory-logger.sinks = logger-sink
avro-memory-logger.channels = avro-memory-logger-channel

# 配置Source
#由於我們是在本機測試的，所以port設定的是127.0.0.1
avro-memory-logger.sources.avro-source.type = avro
avro-memory-logger.sources.avro-source.bind = 127.0.0.1
avro-memory-logger.sources.avro-source.port = 44444

# 配置Channel
avro-memory-logger.channels.avro-memory-logger-channel.type = memory

# 配置Sinks
avro-memory-logger.sinks.logger-sink.type = logger

# 繫結
avro-memory-logger.sources.avro-source.channels = avro-memory-logger-channel
avro-memory-logger.sinks.avro-sink.channel = avro-memory-logger-channel
 

注意：

需要先啟動avro-source端

$FLUME_HOME/bin/flume-ng agent \
--name avro-memory-logger \
--conf $FLUME_HOME/conf \
--conf-file $FLUME_HOME/conf/avro-memory-logger.conf \
-Dflume.root.logger=INFO,console

再啟動exec-source端

$FLUME_HOME/bin/flume-ng agent \
--name exec-memory-avro \
--conf $FLUME_HOME/conf \
--conf-file $FLUME_HOME/conf/exec-memory-logger.conf \
-Dflume.root.logger=INFO,console
 

日誌收集過程：
1）機器A上監控一個檔案，當我們訪問主站時會有使用者行為日誌記錄到access.log中
2）exec source監控資料，監控到資料後通過channel傳輸到avro sink指定hostname和port
3）由另一個agent的avro source監控hostname和port,資料後通過channel傳遞給控制檯輸出