Alert log monitor help

Question

Hello,
I am very new to shell scripting. Our DB is 10g on AIX. And i wanted to setup something that will monitor my alertlog and send me e-mail out. And i found this online. But have very little knowledge on cronjob. I can set one up. But this script dont tell what goes here. Here is the script that i found online. So if anyone could give me what goes where i would be thankfull. it does says put the check_alert.awk someplace. But is that where the cron comes in place. i mean do i schedule check_alert.awk in my cronjob ??? Just wanted to know what parts goes where and how to set this up the right way so i get e-mail alert for my alert log. a step - step process would be good. Thanks
UNIX shell script to monitor and email errors found in the alert log. Is ran as the oracle OS owner. Make sure you change the "emailaddresshere" entries to the email you want and put the check_alert.awk someplace. I have chosen $HOME for this example, in real life I put it on as mounted directory on the NAS.
if test $# -lt 1
then
echo You must pass a SID
exit
fi
# ensure environment variables set
#set your environment here
export ORACLE_SID=$1
export ORACLE_HOME=/home/oracle/orahome
export MACHINE=`hostname`
export PATH=$ORACLE_HOME/bin:$PATH
# check if the database is running, if not exit
ckdb ${ORACLE_SID} -s
if [ "$?" -ne 0 ]
then
echo " $ORACLE_SID is not running!!!"
echo "${ORACLE_SID is not running!" | mailx -m -s "Oracle sid ${ORACLE_SID} is not running!" "
|emailaddresshere|"
exit 1
fi;
#Search the alert log, and email all of the errors
#move the alert_log to a backup copy
#cat the existing alert_log onto the backup copy
#oracle 8 or higher DB's only.
sqlplus '/ as sysdba' << EOF > /tmp/${ORACLE_SID}_monitor_temp.txt
column xxxx format a10
column value format a80
set lines 132
SELECT 'xxxx' ,value FROM v\$parameter WHERE name = 'background_dump_dest'
exit
EOF
cat /tmp/${ORACLE_SID}_monitor_temp.txt | awk '$1 ~ /xxxx/ {print $2}' > /tmp/${ORACLE_SID}_monitor_location.txt
read ALERT_DIR < /tmp/${ORACLE_SID}_monitor_location.txt
ORIG_ALERT_LOG=${ALERT_DIR}/alert_${ORACLE_SID}.log
NEW_ALERT_LOG=${ORIG_ALERT_LOG}.monitored
TEMP_ALERT_LOG=${ORIG_ALERT_LOG}.temp
cat ${ORIG_ALERT_LOG} | awk -f $HOME/check_alert.awk > /tmp/${ORACLE_SID}_check_monitor_log.log
rm /tmp/${ORACLE_SID}_monitor_temp.txt 2>/dev/null
if [ -s /tmp/${ORACLE_SID}_check_monitor_log.log ]
then
echo "Found errors in sid ${ORACLE_SID}, mailed errors"
echo "The following errors were found in the alert log for ${ORACLE_SID}" > /tmp/${ORACLE_SID}_check_monitor_log.mail
echo "Alert log was copied into ${NEW_ALERT_LOG}" >> /tmp/${ORACLE_SID}_check_monitor_log.mail
echo " "
date >> /tmp/${ORACLE_SID}_check_monitor_log.mail
echo "--------------------------------------------------------------">>/tmp/${ORACLE_SID}_check_monitor_log.mail
echo " "
echo " " >> /tmp/${ORACLE_SID}_check_monitor_log.mail
echo " " >> /tmp/${ORACLE_SID}_check_monitor_log.mail
cat /tmp/${ORACLE_SID}_check_monitor_log.log >> /tmp/${ORACLE_SID}_check_monitor_log.mail
cat /tmp/${ORACLE_SID}_check_monitor_log.mail | mailx -m -s "on ${MACHINE}, MONITOR of Alert Log for ${ORACLE_SID} found errors" "
|emailaddresshere|"
mv ${ORIG_ALERT_LOG} ${TEMP_ALERT_LOG}
cat ${TEMP_ALERT_LOG} >> ${NEW_ALERT_LOG}
touch ${ORIG_ALERT_LOG}
rm /tmp/${ORACLE_SID}_monitor_temp.txt 2> /dev/null
rm /tmp/${ORACLE_SID}_check_monitor_log.log
rm /tmp/${ORACLE_SID}_check_monitor_log.mail
exit
fi;
rm /tmp/${ORACLE_SID}_check_monitor_log.log > /dev/null
rm /tmp/${ORACLE_SID}_monitor_location.txt > /dev/null
The referenced awk script (check_alert.awk). You can modify it as needed to add or remove things you wish to look for. The ERROR_AUDIT is a custom entry that a trigger on DB error writes in our environment.
$0 ~ /Errors in file/ {print $0}
$0 ~ /PMON: terminating instance due to error 600/ {print $0}
$0 ~ /Started recovery/{print $0}
$0 ~ /Archival required/{print $0}
$0 ~ /Instance terminated/ {print $0}
$0 ~ /Checkpoint not complete/ {print $0}
$1 ~ /ORA-/ { print $0; flag=1 }
$0 !~ /ORA-/ {if (flag==1){print $0; flag=0;print " "} }
$0 ~ /ERROR_AUDIT/ {print $0}
I simply put this script into cron to run every 5 minutes passing the SID of the DB I want to monitor.

Answer 1

I have a PERL script that I wrote that does exactly what you want and I'll be glad to share that with you along with the CRON entries.
The script runs opens the current alert_log and searches for key phrases and send e-mail if it finds anything. It then sleeps for 60 sec, wakes up and reads from were it left off to the bottom of the file, searching again and then sleeping. The only down side is it keeps a file handle open on the alert_log, so you have to kill this processes if you want to rename or delete the alert_log.
My email in my profile is not hidden.
Tom