The use of the QSI_ALERT_TAIL_xxxx tables on monitored Oracle database? (86266)

In Oracle cartridges prior to 5.6.10.5, using a change management tool (such as SQLGuard) there are a lot of alerts regarding tables which are being created (i.e. CREATE TABLE) whose name starts QSI_ALERT_TAIL_ and then deleted (DROP TABLE). They are being performed by the Oracle user specified in the Oracle agent's properties. Is this normal?

THIS ARTICLE IS RELEVANT FOR ORACLE CARTRIDGES PRIOR TO 5.6.10.5 WHEN THE ALERT LOG WAS CHANGED TO AN OS COLLECTION.

Foglight's Alert Log Monitoring function requires the dropping and creating of QSI_ALERT_TAIL tables. This external table feature may cause create table messages to be observed in log files. Each time when running, the Alert Log collection creates an external table pointing to the last x lines in alert.log file (500 by default, could be customized via Agent Administration), reads the content of the file and drops the table. For the database cartridge, the drop/create process is applied only for the Alert log feature.

For the naming convention, the prefix of the files is QSI_ALERT_TAIL_ which is appended by the Unix Epoch create time.

For example:
QSI_ALERT_TAIL_1330995810708 would be 05-MAR-12 06.03.40.037523 PM -07:00

If the alert log collection is active in Foglight on both instances, then the same drop/create mechanism will be in use. Should external monitoring not track these file changes then this would appear to be an issue with the configuration in the external tool. Foglight itself does not track the creating and deletion of these QSI_ALERT_TAIL tables.

Yes it is entirely normal and due to the way Foglight monitors monitors an Oracle alert log.

To avoid these alerts it is easiest to exclude the Oracle user being used by the agent from being monitored by the change management tool.

This process will not access or affect the customer data tables in the monitored database.

In the 5.6.5 version of the Oracle cartridge it began using a common table for the Alert log monitoring, rather than numerous individual tables named QSI_ALERT_TAIL_<EPOCH_TIME> that are used in pre-5.6.5 cartridge versions.