This topic describes how to use Flume to synchronize audit logs to HDFS in real time.
Prerequisites
Background information
In EMR V3.19.0 and later, you can configure and manage Flume agents in the EMR console.
The following figure shows the topology of Flume agents.

Notice You can adjust the topology as needed.
For other use scenarios of Flume, see Configure Flume.
Start a Flume agent
- Go to the Flume page.
- Log on to the EMR console.
- In the top navigation bar, select the region where your cluster resides. Select the resource group as required. By default, all resources of the account appear.
- Click the Cluster Management tab.
- On the Cluster Management page that appears, find the target cluster and click Details in the Actions column.
- In the left-side navigation pane, click Cluster Service and then FLUME.
- Configure core node parameters.
- Configure master node parameters.
- Start the Flume agents.
- In the upper-right corner of the Service Configuration section, click Save.
- In the Confirm Changes dialog box, specify the parameters and click OK.
- Select Restart All Components from the Actions drop-down list in the upper-right corner.
- In the Cluster Activities dialog box, specify the parameters and click OK.
- In the Confirm message, click OK.
View logs
The logs of Flume agents are stored in the flume.log file in the /mnt/disk1/log/flume/default-agent/ directory.
View monitoring information
You can view the monitoring information of Flume agents on the Status tab for the Flume service.