I suggest to go through the NameNode logs and ZKFailoverController logs
- In the restarted NameNode log, search SHUTDOWN_MSG and STARTUP_MSG you will know the NN stop/start point. And you may want to go through the logs before SHUTDOWN_MSG to figure out what causes NN to shutdown.
- If HA is enabled, check both zk failover controller log which co-located in same hosts with NN:
ZKFC1:
2021-08-01 01:56:22,924 INFO ha.ZKFailoverController (ZKFailoverController.java:becomeStandby(494)) - Successfully transitioned NameNode at hostname/ip:8020:8020 to standby state
ZKFC2:
2021-08-01 01:56:07,105 INFO ha.ZKFailoverController (ZKFailoverController.java:becomeActive(392)) - Successfully transitioned NameNode at hostname/ip:8020 to active state