4.1 AlertLog

Use this Knowledge Script to scan the Oracle RAC alert logs for entries that match a specified search string. You can set a maximum threshold for the number of occurrences of the string found during any single scan of the alert log. If during any single scan of the alert log the number of matching entries exceeds the threshold, the job raises an event.

This Knowledge Script monitors three alert logs. The following is the name of each alert logs:

  • Database Instance Alertlog-alert.SID.log

  • ASM Instance Alertlog-alert_ASMInstanceID.log

  • Clusterware Alertlog-alerthostname.log/alert.log

This Knowledge Script scans the three alert logs for specific entries.

The first interval of this script scans all the existing entries in each alert log file. It sets a pointer to the end of the alert log so that only new entries are read. In order to enable the script to event in the first iteration with all entries that match the search criteria in the full file. Each subsequent iteration of the script scans the alert log for entries created since the previous scan. To view all entries, set the parameter Override scan from beginning of the log for first iteration.

Information in the Event Properties states the number of occurrences of the search string that were found. The lines containing matches found in the log are also included in the event details.

Scanning a large log, bigger than 1 GB for example, might use more operating system resources than you want this script to use. If that happens, reduce the size of the log.

The account you use to run this script must have SELECT permissions for the following tables:

V_$PARAMETER

 

V_$VERSION

 

V_$DIAG_INFO

(for Oracle 11g and later)

NOTE:When the Oracle RAC alert log reaches its maximum size, Oracle renames the file for archiving purposes and creates a new alert log with the original filename. If this script attempts to open the alert log between the time the old file is renamed and the new file is created, the job raises an event because the script cannot find the file. The next iteration of the script (when the alert log is available) should function as expected.

This Knowledge Script runs on the remote cluster node to retrieve the matching entries. To connect to the remote cluster node, the script assumes the grid username of every node in the cluster is the same as the grid username given for one or more cluster nodes during Discovery.

This Knowledge Script is supported on Oracle 11gR2 and Oracle 12c.

4.1.1 Resource Objects

Individual Oracle RAC Database Instances, ASM Instances and Clusterware icons under each node. When you drop the script on an Oracle RAC Database/ASM Instance/Clusterware icon, a job executes on that Instance/Clusterware and monitors only that item.

4.1.2 Default Schedule

The default interval for this script is Every 30 minutes.

4.1.3 Setting Parameter Values

Set the following parameters as needed:

Description

How to Set It

General Settings

Cluster(s) to exclude

Enter the cluster names to exclude with a comma (,) between each cluster name, to exclude the cluster from all jobs.

Event severity when job fails

Set the event severity level, from 1 to 40, to indicate the importance of the event. The default is 5 (red event indicator).

Enable debugging?

Select Yes to enable debugging. The default is unselected.

Raise event if AppManager fails to get metrics?

Select Yes to raise an event when AppManager fails to get the metrics. The default is Yes.

Event severity

Set the event severity level, from 1 to 40, to indicate the importance of the event. The default is 5 (red event indicator).

Event Settings

Monitor DB Instances Alert logs?

Include Search Options

Enter a regular expression with one of the following options;

  • Regular expression specifying the include filter: Enter a regular expression in Perl, to identify the pattern you want to look for in the text file being monitored. Strings matching the include filter pattern are returned. The expression, .+, matches all strings. The default is ^(ORA-00603|ORA-00257|ORA-01157|ORA-27048|ORA-0060|ORA-7445|ORA-16038|ORA-4030|ORA-4031|ORA-353|ORA-604)

  • Optional file with regular expressions specifying the include filter: If you do not want to enter a regular expression in the Regular expression specifying the include filter parameter, specify the full path to a file containing the regular expression specifying the include filter. The default is blank.

  • Modifier for the regular expression include filter: Enter any modifier you want to use to change the behavior of the regular expression. For example, specifying i for this parameter makes the include filter case-insensitive. The default is i.

Exclude Search Options

Enter a regular expression with one of the following options;

  • Regular expression specifying the exclude filter: Enter a regular expression in Perl, to identify the pattern you want exclude from the text file being monitored. Strings matching the include filter pattern are returned. The default is blank.

  • Optional file with regular expressions specifying the exclude filter: Enter the full path to a file containing any additional filter items you want to exclude. Strings matching the include filter pattern are returned. The default is blank.

  • Modifier for the regular expression exclude filter: Enter any modifier you want to use to change the behavior of the regular expression. For example, specifying i for this parameter makes the exclude filter case-insensitive. The default is blank.

Raise event if threshold exceeded for DB instances alert logs?

Select Yes to raise an event when the number of DB instances alert log entries found that match the search criteria exceeds the threshold you set. The default is Yes.

Threshold - Maximum number of entries found

Enter a threshold for the maximum number of log entries that can be found to match the search criteria during any single scan of the alert log. If the number of entries matches or exceeds the threshold, the job raises an event. The default is 0.

Severity

Set the event severity level, from 1 to 40, to indicate the importance of the event. The default is 5 (red event indicator).

Monitor Cluster Alert logs?

Include Search Options

Enter a regular expression with one of the following options;

  • Regular expression specifying the include filter: Enter a regular expression in Perl, to identify the pattern you want to look for in the text file being monitored. Strings matching the include filter pattern are returned. The expression, .+, matches all strings. The default is ^(CRS-1607|CRS-1805|CRS-1009)

  • Optional file with regular expressions specifying the include filter: If you do not want to enter a regular expression in the Regular expression specifying the include filter parameter, specify the full path to a file containing the regular expression specifying the include filter. The default is blank.

  • Modifier for the regular expression include filter: Enter any modifier you want to use to change the behavior of the regular expression. For example, specifying i for this parameter makes the include filter case-insensitive. The default is i.

Exclude Search Options

Enter a regular expression with one of the following options;

  • Regular expression specifying the exclude filter: Enter a regular expression in Perl, to identify the pattern you want exclude from the text file being monitored. Strings matching the include filter pattern are returned. The default value is blank.

  • Optional file with regular expressions specifying the exclude filter: Enter the full path to a file containing any additional filter items you want to exclude. Strings matching the include filter pattern are returned. The default is blank.

  • Modifier for the regular expression exclude filter: Enter any modifier you want to use to change the behavior of the regular expression. For example, specifying i for this parameter makes the exclude filter case-insensitive. the default is blank.

Raise event if threshold exceeded for Cluster alert logs?

Select Yes to raise an event when the number of Cluster alert log entries found that match the search criteria exceeds the threshold you set. The default is Yes.

Threshold - Maximum number of entries found

Enter a threshold for the maximum number of log entries that can be found to match the search criteria during any single scan of the alert log. If the number of entries matches or exceeds the threshold, the job raises an event. The default is 0.

Severity

Set the event severity level, from 1 to 40, to indicate the importance of the event. The default is 5 (red event indicator).

Monitor ASM Instance Alert logs?

Include Search Options

Enter a regular expression with one of the following options;

  • Regular expression specifying the include filter: Enter a regular expression in Perl, to identify the pattern you want to look for in the text file being monitored. Strings matching the include filter pattern are returned. The expression, .+, matches all strings. The default is ^(ASM-1578).

  • Optional file with regular expressions specifying the include filter: If you do not want to enter a regular expression in the Regular expression specifying the include filter parameter, specify the full path to a file containing the regular expression specifying the include filter. The default is blank.

  • Modifier for the regular expression include filter: Enter any modifier you want to use to change the behavior of the regular expression. For example, specifying i for this parameter makes the include filter case-insensitive. The default is i.

Exclude Search Options

Enter a regular expression with one of the following options;

  • Regular expression specifying the exclude filter: Enter a regular expression in Perl, to identify the pattern you want exclude from the text file being monitored. Strings matching the include filter pattern are returned. The default is blank.

  • Optional file with regular expressions specifying the exclude filter: Enter the full path to a file containing any additional filter items you want to exclude. Strings matching the include filter pattern are returned. The default is blank.

  • Modifier for the regular expression exclude filter: Enter any modifier you want to use to change the behavior of the regular expression. For example, specifying i for this parameter makes the exclude filter case-insensitive. The default is blank.

Raise event if threshold exceeded for ASM instance alert logs?

Select Yes to raise an event when the number of ASM instance alert log entries found that match the search criteria exceeds the threshold you set. The default is Yes.

Threshold - Maximum number of entries found

Enter a threshold for the maximum number of log entries that can be found to match the search criteria during any single scan of the alert log. If the number of entries matches or exceeds the threshold, the job raises an event. The default is 0.

Severity

Set the event severity level, from 1 to 40, to indicate the importance of the event. The default is 5 (red event indicator).

Override scan from beginning of the log for first iteration?

Select Yes to override the scan from the beginning of the log for the first iteration. The default is unselected.

Maximum number of entries per event report

Enter the maximum number of entries per event report. The default is 1000.

Data Collection

Collect data for number of matching log entries for DB instances alert logs?

Select Yes to collect data for the number of matching log entries for DB instances alert logs. The default is Yes.

Collect data for number of matching entry log entries for Cluster alert logs?

Select Yes to collect data for the number of matching log entries for Cluster alert logs. The default is Yes.

Collect data for number of matching log entries for ASM instances alert logs?

Select Yes to collect data for the number of matching log entries or ASM instances alert logs. The default is Yes.