More information about Oracle Alert Log monitoring (4307664)

• Does Oracle Alert log monitoring require an OS connection?
• How many rows are sampled by default?
• What is a Matching List?
• What is an Ignore List?
• How to customize Alert Log collection?
• Why do I see "create table" in my agent log?
• Why I cannot see old trace file by click?
• How is the alert log parsed?
• Does CREATE ANY DIRECTORY permission really required for Alert log collection?
• Does the Alert Log monitoring requires drooping and creating of QSI_ALERT_TAIL table?

Alert Log allows for handling of Oracle Alarms. The configuration of the Alert Log can be done by entering the Global Administration are for Oracle | Alert Log.

There are three defaults set for Oracle Log:

1. Alert log summary : counts number of messages starting with Critical severity (default)
2. Alert log message : Disabled by default, if enabled - will fire each time when message starting with specified severity appears
3. Number of rows collected from log: By default the Agent reads last lines from alert.log file that was added since previous sampling, up to 500 lines from the end of file.

The Agent connects at the Database level (windows and UNIX) and hence reads the information from the alert log.

Important: in versions of the Oracle cartridge prior to 5.6.10.5 no OS connection is required.

Firing Alarms

Alarms will be fired each time when event occurs, does not depends on previous alarms and never cleared automatically.

• For Alert log summary: one alarm will be fired for ALL events, starting with Critical severity (by default)
• For Alert log message: one alarm per each event (Alert log message) will be fired

Checking the Alarms fired by Alert Log
The alarms fired by Alert Log appear under the Instance column in the Alarm pop-up screen. Clicking the Alert log alarms allows further Investigation to take place.

Matching list and Ignore list
The alarms of Alert log can be configured by using matching list and ignore list. The Match list can be edited to add required alert messaged, edit the existing records in the list, enable or disable alarms for certain alert messages. Updating the Matching list will not filter the alert messages from the alert log screen, removing the record from Matching list will map the message with severity Informational under Other type.

Adding the alert message to ignore list will filter the message out of alert messages screen.

Alert Log Dashboard: Configuration | Alert Log
The Alert Log Dashboard displays all alert log messages, except messages defined in "Ignore List". Messages that match the "Match List" patterns displayed under pre-defined name, category and severity. All the rest will appear under name "Other", type "Oracle alert messages" with severity "Informational".

Why do I see "create table" in my agent log?
The Alert Log collection uses an external table feature for its internal functionality, this is why a create table message might be observed in log files.

Why I cannot see old trace file by click?
Trace file monitoring is an online collection that reads the trace file by request originated by clicking on a trace file link in an alert log record. As this is an online collection (the information is not stored in the repository), the data is available only if the trace file still exist in the file system and can be accessed.

How is the alert log parsed?
In cartridge versions before 5.6.10.5, the cartridge creates external table that keeps the rows that will be parsed by the agent (no OS connection is required). The maximum number of rows that are read is defined in Number of rows collected from log configuration parameter. The agent parses and submits the retrieved rows in the following way:

• Only the rows that were added to the alert log since the last sampling date will be parsed
• The rows containing regular expressions that are defined in the Ignore List will never be submitted
• The rows containing regular expressions that are defined in the Match List will be mapped and submitted according to the Severity defined in the Match List
• if the alert log was removed from the file system, no Alert Log parsing will be available, as the cartridge is monitoring OS file and not using Oracle utilities for accessing the file

Oracle cartridges beginning with 5.6.10.5 and higher use a OS connection to collect Alert Log data.

Does CREATE ANY DIRECTORY permission really required for Alert log collection?
In cartridge versions prior to 5.6.10.5, the Alert Log collection creates an oracle directory that points to background_dump_dest OS directory in order to read oracle alert.log. In order to achieve that goal, GRANT CREATE ANY DIRECTORY TO &USER_NAME permission is used by Alert log collection. In general it can be revoked, however if the directory will change/become invalid/etc`, the agent will not be able to recreate it automatically and the collection will fail.

However, it is possible to quickly revoke that grant and still maintain Alert log collection as follows:

• The customer can run the permissions script as is for the first time. The directory itself will be created on the first initialization of the Alert log collection. From that point on, the customer can revoke the CREATE ANY DIRECTORY PERMISSIONS and yet gain the ability to have Alert Log collection.
• In case a permission was revoked and for some reason, and the background_dump_dest destination changes, the agent will not be able to recreate a directory to point to a new destination and the Alert Log collection will fail.

Does the Alert Log monitoring requires drooping and creating of QSI_ALERT_TAIL table?
Yes for Oracle cartridge versions before 5.6.10.5. Each time when running, the Alert Log collection creates external table pointing to the last x lines in alert.log file (500 by default, could be customized via Agent Administration), reads the content of the file and drops the table.