tailf | Like tailf | Frontend Framework library

You could use a regex:

Why my JVM did 3 times of FullGC when it started?

The first and third Full GCs were triggered by metaspace hitting its current threshold and needing to grow. Since metaspace is primarily used to hold code-related things, this implies that Flink is loading a lot of code or generating a lot of dynamic proxies or something like that.

You might consider increasing the initial metaspace size.

The second Full GC was triggered by an explicit System.gc() call. My guess is that Flink is doing that.

I thought FullGC would decrease Tenured space.

Not necessarily. If the Full GC was triggered by metaspace filling, then you could well find that a lot of objects in new space were tenured. In the first case, it is clear that that has happened, since prior to the GC, tenured space was empty.

... while metaspace don't change, and even increase between GCs

That means that the GC is not finding any garbage in metaspace. I would only expect metaspace to usage to decrease if a ClassLoader instance (and all of its classes, and all of their instances) became unreachable. It is expected that metaspace usage will increase during startup. It is only potentially concerning if it continues increasing after the application has started and the JVM has full warmed up.

You'll have to use Flume headers

Kafka Sink uses the topic and key properties from the FlumeEvent headers to send events to Kafka. If topic exists in the headers, the event will be sent to that specific topic, overriding the topic configured for the Sink. If key exists in the headers, the key will used by Kafka to partition the data between the topic partitions

Headers can be added with interceptors

.http://flume.apache.org/releases/content/1.9.0/FlumeUserGuide.html#flume-interceptors

Your Here Docs specify EOF to end them (<< EOF) but you never have an EOF to end them. Note that EOF doesn't mean End of File, it means the string 'EOF'. https://en.wikipedia.org/wiki/Here_document has examples.

I'm not sure what you're hoping to accomplish, but it looks to me that you need to specify which file to tail. Are you hoping to pass the inner case into the remote shell on the server you're sshing into? It would simplify your code to set your filename and servername first and then ssh and execute the command. Actually, I don't see much purpose in your inner case statements anyway. Instead of wrapping everything in the 'env' case, you could just set the hostname to a variable. And then the "servername" can just be interpolated into the filesystem path. something like this seems like a simple approach:

Installation requires su permission.

Try sudo make install

As it is evident from comments below the question that variable contains newlines after each process id, you may use this xargs command in remote ssh:

You should create a variable that is local in scope that points to your logging object. From the logging docs:

Multiple calls to getLogger() with the same name will always return a reference to the same Logger object.

So, having set up your logger object initially, then wherever you want to log something, call getLogger(). In your class, this is best done in __init__ and made an instance attribute, i.e.:

Upon investigating i found that the rule can be combined by multiple syscall -S for more info the follwoing url can be reffered:-

https://www.digitalocean.com/community/tutorials/how-to-write-custom-system-audit-rules-on-centos-7

the syscall open did the trick once concatenating with the syscall execve the following rule set was obtained:-

/etc/audit/rules.d/audit.rules:-

The JSON represented in the string needs the backslashes, as apparently the represented object has property values that themselves are JSON encoded strings. These embedded strings need their double quotes to be escaped. Remove them would make the overall JSON invalid.

What you may need is to resolve the embedded JSON strings to the objects they represent. For this you would best use a recursive function that uses the json.loads method to parse each of the nested JSONs.

NB: it is not a good idea to use the name str for your data, as that is the name of the Python data type.

Here is suggested solution: