Use this Knowledge Script to scan the Oracle RDBMS alert log for entries that match a specified search string. You can set a maximum threshold for the number of occurrences of the string found during any single scan of the alert log. If during any single scan of the alert log the number of matching entries exceeds the threshold, the job raises an event.
Each database maintains an alert log where it records database operations (such as creating or dropping a database) and error conditions (such as deadlocks). This script provides a general‑purpose tool for scanning a database’s alert log for specific entries.
The first interval of this script does not scan existing entries and does not collect data. Instead, it sets a pointer to the end of the alert log so that only new entries are read. Each subsequent iteration of the script scans the alert log for entries created since the previous scan. Information in the Event Properties dialog box states the number of occurrences of the search string that were found. The lines containing matches found in the log are also included in the event details.
Scanning a large log, bigger than 1 GB for example, might use more operating system resources than you want this script to use. If that happens, reduce the size of the log.
The account you use to run this script must have SELECT permissions for the following tables:
V_$PARAMETER |
|
V_$VERSION |
|
V_$DIAG_INFO |
(for Oracle 11g and later) |
NOTE:When the Oracle alert log reaches its maximum size, Oracle renames the file for archiving purposes and creates a new alert log with the original filename. If this script attempts to open the alert log between the time the old file is renamed and the new file is created, the job raises an event because the script cannot find the file. The next iteration of the script (when the alert log is available) should function as expected.
This script attempts to open the alert log associated with the relevant Oracle instance. Oracle instance alert logs use the naming convention alert_<instance name>.
Oracle Database folders. When you drop a script on an Oracle Database folder, a job executes on that database and monitors only that database.
The default interval for this script is Every 10 minutes.
Set the following parameters as needed:
|
Description |
How to Set It |
|---|---|
|
Oracle Username |
Enter the username that this script needs to access the target databases. If you run this script on more than one database, configure each database with the same username. To use SYSDBA authentication, leave this parameter blank. The default is blank. |
|
Collect data for number of matching log entries? |
Select Yes to collect data for charts and reports. When you enable data collection, the Knowledge Script returns the number of entries that matched the search string. The default is unselected. |
|
Include Search Options |
|
|
Regular expression specifying the include filter |
Enter a regular expression in Perl, to identify the pattern you want to look for in the text file being monitored. Strings matching the include filter pattern are returned. The expression, .+, matches all strings. The default is ^(ORA-1578|ORA-60). |
|
Optional file with regular expressions specifying the include filter |
If you do not want to enter a regular expression in the Regular expression specifying the include filter parameter, specify the full path to a file containing the regular expression by specifying the include filter. |
|
Modifier for the regular expression include filter |
Enter any modifier you want to use to change the behavior of the regular expression. For example, specifying i for this parameter makes the include filter case-insensitive. The default is i. |
|
Exclude Search Options |
|
|
Regular expression specifying the exclude filter |
Enter a regular expression, in Perl, to identify the pattern you want to exclude from matching in the text file being monitored. Strings matching the include filter pattern are returned. |
|
Optional file with regular expressions specifying the exclude filter |
Enter the full path to a file containing any additional filter items you want to match. You can also use this parameter if you only want to specify matching expressions in an external file. |
|
Modifier for the regular expression exclude filter |
Optional modifiers can be used to change the behavior of the regular expression. For example, specifying “i” for this parameter makes the exclude filter case-insensitive. |
|
Raise event if threshold exceeded? |
Select Yes to raise an event when the number of log entries found that match the search criteria exceeds the threshold you set. The default is Yes. |
|
Threshold - Maximum number of entries found |
Enter a threshold for the maximum number of log entries that can be found to match the search criteria during any single scan of the alert log. If the number of entries matches or exceeds the threshold, the job raises an event. The default is 0. |
|
Severity |
Set the event severity level, from 1 to 40, to indicate the importance of the event. The default is 5 (red event indicator). |
|
Maximum number of entries per event report |
Enter the maximum number of entries per event report. The default is 1000. |
|
Event severity for internal failure |
Set the event severity level, from 1 to 40, to indicate the importance of the event. The default is 5 (red event indicator). |