DRFAAUDIT is in ./hadoop-common-project/hadoop-common/src/main/packages/templates/conf/log4j.properties but not in ./hadoop-common-project/hadoop-common/src/main/conf/log4j.properties (although it's used in hadoop-env.sh)
lesser issues but I noticed:
I see MRAUDIT commented out of main, but it's uncommented in template. (the conversion pattern also differs).
afaict the other appenders (JSA, MRAUDIT, TLA, etc...) are all still being used and should not be removed.
Should we be renaming some of these? JSA is being used by the history server for example.