Alert log monitoring in dbconsole 11.2.0.2.0

Hullo
Is there a way to tune out certain ORA- alerts from alerting via dbconsole? At the moment we are getting all ORA-0600s and some of them we dont need waking up by!
Thanks.
11.2.0.3
RHEL 5.5

Do you have metalink support? This is the doc you want to check into .. yes it is possible.
Database Alert log monitoring in 12c explained (Doc ID 1538482.1)
From this doc...
You need to get fancy with the regexp..
Setting thresholds for alert log metrics
Setting of the thresholds is a very complex and wide area and the values are depending on the requirements, the DBA experience and environments being monitored. This can be achieved by going to the Database target menu->Monitoring->Metrics and collection settings->Edit the "Generic Alert Log Error" from the 3 blue pencils icon on the right.
By default, the "Generic Alert Log Error" Warning threshold is set to "ORA-0*(600?|7445|4[0-9][0-9][0-9])[^0-9]" which means:
ORA-0*(600?|7445|4[0-9][0-9][0-9])[^0-9] - the string ORA-0
ORA-0*(600?|7445|4[0-9][0-9][0-9])[^0-9] - folowed by none ore more zeroes
ORA-0*(600?|7445|4[0-9][0-9][0-9])[^0-9] - followed by 600 or 60 (the ? operator means "there is zero or one of the preceding element")
ORA-0*(600?|7445|4[0-9][0-9][0-9])[^0-9] - or it can be 7445
ORA-0*(600?|7445|4[0-9][0-9][0-9])[^0-9] - or it can be anything between 4000 and 4999
ORA-0*(600?|7445|4[0-9][0-9][0-9])[^0-9] - it can follow anything but a number
For setting the thresholds, a Regular expression (RegExp) as the one above needs to be used.

Similar Messages

Alert log monitoring problem

Hi guys!
I have found good simple script for alert log monitoring BUT it doesnt shows date and time. How to format it so that i could see date and time as well in log output?
+#!/bin/sh+
+#GLOBS+
ALERT="ORA-";
LOGFILE=/path/to/my/alert_X.log
MYFILE=/home/user/test.log
+##+
+#get the errors out of the logfile.+
grep -h "$ALERT" $LOGFILE >> $MYFILE
+#count number of lines in myfile, and print.+
+VAR=`wc -l $MYFILE | awk -F" " '{print $1}'`+
+#echo $VAR+
+# if the amount of lines is greater than 0, then cat the file and send it to me. if not then echo all clear.+
+#size variable is the number of errors the last time the script ran+
+size=`wc -l test.last | awk -F" " '{print $1}'`+
echo $size
+# if the amount of lines is greater than 0, then cat the file and send it to me. if not then echo all clear+
+if [[ $VAR -gt $size ]] ; then+
cat $MYFILE | mail -vs "oralert" [email protected] ;
else
echo "All clear.."
fi;
rm test.last
mv test.log test.last
touch test.log

The alert_log is know to first put the date of the message into it, and then on the next line the ORA- error message.
So in the case you would find an ORA-error here, then what is the problem into going into the file and start looking at what time it occured.
Otherwise you would have to modify the script in such way that it will get more info than a 'grep' at the moment it finds the error, like using "grep -l" option, that simply matches the lines.
Then a while loop in the script could "walk" trough these lines and get the surrounding lines around that line number from the alert_log.
But, again, if an error pops up, you do want to go into the alert-file, looking up all given info e.g. about the object(s) involved, the users, if a tracefile was generated...etc,etc,.
FJFranken

Alert log monitor help

Hello,
I am very new to shell scripting. Our DB is 10g on AIX. And i wanted to setup something that will monitor my alertlog and send me e-mail out. And i found this online. But have very little knowledge on cronjob. I can set one up. But this script dont tell what goes here. Here is the script that i found online. So if anyone could give me what goes where i would be thankfull. it does says put the check_alert.awk someplace. But is that where the cron comes in place. i mean do i schedule check_alert.awk in my cronjob ??? Just wanted to know what parts goes where and how to set this up the right way so i get e-mail alert for my alert log. a step - step process would be good. Thanks
UNIX shell script to monitor and email errors found in the alert log. Is ran as the oracle OS owner. Make sure you change the "emailaddresshere" entries to the email you want and put the check_alert.awk someplace. I have chosen $HOME for this example, in real life I put it on as mounted directory on the NAS.
if test $# -lt 1
then
echo You must pass a SID
exit
fi
# ensure environment variables set
#set your environment here
export ORACLE_SID=$1
export ORACLE_HOME=/home/oracle/orahome
export MACHINE=`hostname`
export PATH=$ORACLE_HOME/bin:$PATH
# check if the database is running, if not exit
ckdb ${ORACLE_SID} -s
if [ "$?" -ne 0 ]
then
echo " $ORACLE_SID is not running!!!"
echo "${ORACLE_SID is not running!" | mailx -m -s "Oracle sid ${ORACLE_SID} is not running!" "
|emailaddresshere|"
exit 1
fi;
#Search the alert log, and email all of the errors
#move the alert_log to a backup copy
#cat the existing alert_log onto the backup copy
#oracle 8 or higher DB's only.
sqlplus '/ as sysdba' << EOF > /tmp/${ORACLE_SID}_monitor_temp.txt
column xxxx format a10
column value format a80
set lines 132
SELECT 'xxxx' ,value FROM v\$parameter WHERE name = 'background_dump_dest'
exit
EOF
cat /tmp/${ORACLE_SID}_monitor_temp.txt | awk '$1 ~ /xxxx/ {print $2}' > /tmp/${ORACLE_SID}_monitor_location.txt
read ALERT_DIR < /tmp/${ORACLE_SID}_monitor_location.txt
ORIG_ALERT_LOG=${ALERT_DIR}/alert_${ORACLE_SID}.log
NEW_ALERT_LOG=${ORIG_ALERT_LOG}.monitored
TEMP_ALERT_LOG=${ORIG_ALERT_LOG}.temp
cat ${ORIG_ALERT_LOG} | awk -f $HOME/check_alert.awk > /tmp/${ORACLE_SID}_check_monitor_log.log
rm /tmp/${ORACLE_SID}_monitor_temp.txt 2>/dev/null
if [ -s /tmp/${ORACLE_SID}_check_monitor_log.log ]
then
echo "Found errors in sid ${ORACLE_SID}, mailed errors"
echo "The following errors were found in the alert log for ${ORACLE_SID}" > /tmp/${ORACLE_SID}_check_monitor_log.mail
echo "Alert log was copied into ${NEW_ALERT_LOG}" >> /tmp/${ORACLE_SID}_check_monitor_log.mail
echo " "
date >> /tmp/${ORACLE_SID}_check_monitor_log.mail
echo "--------------------------------------------------------------">>/tmp/${ORACLE_SID}_check_monitor_log.mail
echo " "
echo " " >> /tmp/${ORACLE_SID}_check_monitor_log.mail
echo " " >> /tmp/${ORACLE_SID}_check_monitor_log.mail
cat /tmp/${ORACLE_SID}_check_monitor_log.log >> /tmp/${ORACLE_SID}_check_monitor_log.mail
cat /tmp/${ORACLE_SID}_check_monitor_log.mail | mailx -m -s "on ${MACHINE}, MONITOR of Alert Log for ${ORACLE_SID} found errors" "
|emailaddresshere|"
mv ${ORIG_ALERT_LOG} ${TEMP_ALERT_LOG}
cat ${TEMP_ALERT_LOG} >> ${NEW_ALERT_LOG}
touch ${ORIG_ALERT_LOG}
rm /tmp/${ORACLE_SID}_monitor_temp.txt 2> /dev/null
rm /tmp/${ORACLE_SID}_check_monitor_log.log
rm /tmp/${ORACLE_SID}_check_monitor_log.mail
exit
fi;
rm /tmp/${ORACLE_SID}_check_monitor_log.log > /dev/null
rm /tmp/${ORACLE_SID}_monitor_location.txt > /dev/null
The referenced awk script (check_alert.awk). You can modify it as needed to add or remove things you wish to look for. The ERROR_AUDIT is a custom entry that a trigger on DB error writes in our environment.
$0 ~ /Errors in file/ {print $0}
$0 ~ /PMON: terminating instance due to error 600/ {print $0}
$0 ~ /Started recovery/{print $0}
$0 ~ /Archival required/{print $0}
$0 ~ /Instance terminated/ {print $0}
$0 ~ /Checkpoint not complete/ {print $0}
$1 ~ /ORA-/ { print $0; flag=1 }
$0 !~ /ORA-/ {if (flag==1){print $0; flag=0;print " "} }
$0 ~ /ERROR_AUDIT/ {print $0}
I simply put this script into cron to run every 5 minutes passing the SID of the DB I want to monitor.

I have a PERL script that I wrote that does exactly what you want and I'll be glad to share that with you along with the CRON entries.
The script runs opens the current alert_log and searches for key phrases and send e-mail if it finds anything. It then sleeps for 60 sec, wakes up and reads from were it left off to the bottom of the file, searching again and then sleeping. The only down side is it keeps a file handle open on the alert_log, so you have to kill this processes if you want to rename or delete the alert_log.
My email in my profile is not hidden.
Tom

Alert log monitoring

Hi guys is there any kind of free utility or script which could send me peice of last alert log error produced by remote Oracle database?
I need something similar to OraSentry utility....
Just to say my 10g database work on Win platform.
Thank you!

Here's a script I use for our 9i databases.
# Set environment
. $HOME/.profile
# get a list of all Oracle DB's running and check their alert log for errors
# The 'end of monitoring' string is added to the end of the alert log after each run
# and only the messages after that are processed. Used so we don't double-check
# the same messages.
for SID in `ps -ef | grep pmon | grep -v grep | awk '{print $NF}' | sed 's/_/ /g' | awk '{print $3}'`
do
export ALERT_LOG=$ORACLE_BASE/admin/$SID/bdump/alert_$SID.log
export LASTLINE=`tail -1 $ALERT_LOG | cut -c1-5`
if [ "$LASTLINE" != "#####" ]; then
sed '/##### end of monitoring #####/,$ !d' $ALERT_LOG > /tmp/work.tmp
grep ORA- /tmp/work.tmp
if [ $? -eq 0 ]; then
mailx -s "Errors found in $SID alert log" [email protected] < /tmp/work.tmp
fi
sed '/##### end of monitoring #####/d' $ALERT_LOG > $ALERT_LOG.work
mv $ALERT_LOG.work $ALERT_LOG
echo "##### end of monitoring #####" >> $ALERT_LOG
fi
done
rm /tmp/work.tmp
Start off by inserting a comment at the end of the alert log. I use ##### end of monitoring #####
Next the script will check to see if that is the last line in the alert log. If it is then nothing has been written to the alert log since the last time the script was run...
If there is something, the script grabs everything after the '##### end of monitoring #####' and checks if it includes errors.
If it does it emails them to the dba. If not (ie: just informational messages) then it appends the '##### end of monitoring #####' line to the end of the alert log for the next run.
Edited by: Jamie CC on Jun 4, 2010 6:43 AM

Cloud Control 12c monitoring Oracle 11g Standard Edition alert.log

Hi guys.
I just installed Cloud Control 12c3 and added my cluster database, I have readed many papers, tech docs and tech discuss and now i have a huge confussion about packs, licensing and other fruits. Please help...
I have four Oracle 11g databases (differents hosts) Standard Edition, and i want monitoring and notificate alert.log errors. For example, if alert.log says "ORA-01438, blablabla" i want a email notification.
I read about packs, and says that "diagnostic pack" is needed for alert.log monitoring in Cloud Control 12c. But my version database is Standard Edition without packs, so I CAN'T MONITORING ALERT LOG!!!.
Question:
Do I really need Diagnostic Pack for monitoring alert.log with Cloud Control?
If Diagnostinc Pack is not necessary, how can i monitoring alert.log?
Thanks

I do not think you require any pack for alert.log content monitoring but you might need to check with Oracle rep. I am saying so because if you go to the "Alert log content" page and click on management pack for this page, Grid will display a message that this page does not require any pack.
Go to the Alert log content by "oracle database -> logs -> alert log contents"
then
go to SETUP -> management packs -> packs for this page
You will see the message will be displayed " this pages does not require any pack"
Can you also provide the doc where it says that this pae needs diagnostic pack?

Unix Log Monitoring regular expression not picking up alerts

Hi,
We are moving our unix monitoring to SCOM 2012 SP1 rollup 4.
What I have got working is indvidual alert logging of Unix Log alerts by exporting the MP and changing the <IndividualAlerts> value to true and removing the suppression xml section then reimporting the MP.
What I am trying to do is use the regular expression to peform the suppression of specific event (such as event codes).
The expression is:
((?i:warning)(?!(.*1222)|(.*1001)))
ie Search the log for "warning" (not case sensitive) then check if events 1222 or 1001 exist if so return no match, if they dont exist then return true.
I use the built in test function in SCOM when creating the rule and the tests come back as expected but when I inject test lines into the unix log, no alerts get generted.
I suspect it could be the syntax not being accepted on the system (its running RedHat 6 )
I have tested this with regex tools and works.
When I try and test it on the server i get:
[root@bld02 ~]# grep ((?i:Warning)(?!(.*1222)|(.*1001))) /var/log/messages
-bash: !: event not found
[root@bld02 ~]# tail /var/log/messages
Nov 13 15:07:26 bld02 root: SCOM Test Warning Event ID 1001 Round 18
Nov 13 15:07:29 bld02 root: SCOM Test Warning Event ID 1000 Round 18
Nov 13 15:07:35 bld02 root: SCOM Test Warning Event ID 1002 Round 18
So I am expecting 2 alerts to be generated.
SCOM tests to show expression working:
Test 1 Matching
Test 2 to exclude
Need some help with this, Thankyou in advance :)

Hello,
Here's an example of modifying the MP to exclude particular events. Firstly, I created a log file rule using the MP template that is fairly inclusive - matching the string Warning (with either a lower or upper case W).
I then exported the MP, and modified the rule. I set the IndividualAlerts = true and removed the AlertSuppression element, so that every matched line will fire a unique alert. You don't have to remove the AlertSuppression, but you should use
Individual alerts so that the exclusion logic doesn't exclude concurrent events that you actually want to match.
Implementing the exclusion logic involves the addition of a System.ExpressionFilter definition in the rule. This will use a conditional evaluation of the //row element of the data item. Here's an example of a dataitem matching an individual row:
<DataItem type="System.Event.Data"time="2013-11-15T10:33:14.8839662-08:00"sourceHealthServiceId="667FF365-70DD-6607-5B66-F9F95253B29F">
<EventOriginId>{86AB962D-2F44-29FD-A909-B99FF6FEB2C5}</EventOriginId>
<PublisherId>{EC7EA4B1-0EA5-7E8E-701F-82FEF3367BC4}</PublisherId>
<PublisherName>WSManEventProvider</PublisherName>
<EventSourceName>WSManEventProvider</EventSourceName>
<Channel>WSManEventProvider</Channel>
<LoggingComputer/>
<EventNumber>0</EventNumber>
<EventCategory>3</EventCategory>
<EventLevel>0</EventLevel>
<UserName/>
<RawDescription>Detected Entry: warning 1002</RawDescription>
<CollectDescription Type="Boolean">true</CollectDescription>
<EventData>
<DataItem type="SCXLogProviderDataSourceData"time="2013-11-15T10:33:14.8839662-08:00"sourceHealthServiceId="667FF365-70DD-6607-5B66-F9F95253B29F">
<SCXLogProviderDataSourceData>
<row>warning 1002</row>
</SCXLogProviderDataSourceData>
</DataItem>
</EventData>
<EventDisplayNumber>0</EventDisplayNumber>
<EventDescription>Detected Entry: warning 1002</EventDescription>
</DataItem>
Here is the rule in the MP XML. The <ConditionDetection>...</ConditionDetection> content was what I added to do the exclusion filtering:
<Rule ID="LogFileTemplate_66b86eaded094c309ffd2631b8367a32.Alert" Enabled="false" Target="Unix!Microsoft.Unix.Computer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="EventDS" TypeID="Unix!Microsoft.Unix.SCXLog.VarPriv.DataSource">
<Host>$Target/Property[Type="Unix!Microsoft.Unix.Computer"]/PrincipalName$</Host>
<LogFile>/tmp/test</LogFile>
<UserName>$RunAs[Name="Unix!Microsoft.Unix.ActionAccount"]/UserName$</UserName>
<Password>$RunAs[Name="Unix!Microsoft.Unix.ActionAccount"]/Password$</Password>
<RegExpFilter>warning</RegExpFilter>
<IndividualAlerts>true</IndividualAlerts>
</DataSource>
</DataSources>
<ConditionDetection TypeID="System!System.ExpressionFilter" ID="Filter">
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="String">//row</XPathQuery>
</ValueExpression>
<Operator>DoesNotContainSubstring</Operator>
<Pattern>1001</Pattern>
</RegExExpression>
</Expression>
</ConditionDetection>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertName>Log File Alert: ExclusionExample</AlertName>
<AlertDescription>$Data/EventDescription$</AlertDescription>
</WriteAction>
</WriteActions>
</Rule>
I traced this with the Workflow Analyzer as I tested, which shows the logic being applied. Here is the exclusion happening:
Here's more info on the definition of an ExpressionFilter:
http://msdn.microsoft.com/en-us/library/ee692979.aspx
And more information on Regular Expressions in MPs:
http://support.microsoft.com/kb/2702651/en-us
You can also have multiple Expressions in the ExpressionFilter joined by OR or AND operators.
Also, if you are comfortable with the MP authoring, you can just skip the step of creating the rules in the MP template and just author your own MP with the VSAE tool:
http://social.technet.microsoft.com/wiki/contents/articles/18085.scom-2012-authoring-unixlinux-log-file-monitoring-rules.aspx
www.operatingquadrant.com

Best Way to monitor standby, primary databases, including alert logs, etc.

Hi, Guys, I finally cutover the new environment to the new linux redhat and everything working great so far (the primary/standby).
Now I would like to setup monitoring scripts to monitor it automatically so I can let it run by itself.
What is the best way?
I talked to another dba friend outside of the company and he told me his shop not use any cron jobs to monitor, they use grid control.
We have no grid control. I would like to see what is the best option here? should we setup grid control?
And also for the meantime, I would appreciate any good ideas of any cronjob scripts.
Thanks

Hello;
I came up with this which I run on the Primary daily, Since its SQL you can add any extras you need.
SPOOL OFF
CLEAR SCREEN
SPOOL /tmp/quickaudit.lst
PROMPT
PROMPT -----------------------------------------------------------------------|
PROMPT
SET TERMOUT ON
SET VERIFY OFF
SET FEEDBACK ON
PROMPT
PROMPT Checking database name and archive mode
PROMPT
column NAME format A9
column LOG_MODE format A12
SELECT NAME,CREATED, LOG_MODE FROM V$DATABASE;
PROMPT
PROMPT -----------------------------------------------------------------------|
PROMPT
PROMPT
PROMPT Checking Tablespace name and status
PROMPT
column TABLESPACE_NAME format a30
column STATUS format a10
set pagesize 400
SELECT TABLESPACE_NAME, STATUS FROM DBA_TABLESPACES;
PROMPT
PROMPT ------------------------------------------------------------------------|
PROMPT
PROMPT
PROMPT Checking free space in tablespaces
PROMPT
column tablespace_name format a30
SELECT tablespace_name ,sum(bytes)/1024/1024 "MB Free" FROM dba_free_space WHERE
tablespace_name <>'TEMP' GROUP BY tablespace_name;
PROMPT
PROMPT ------------------------------------------------------------------------|
PROMPT
PROMPT
PROMPT Checking freespace by tablespace
PROMPT
column dummy noprint
column pct_used format 999.9       heading "%|Used"
column name    format a16      heading "Tablespace Name"
column bytes   format 9,999,999,999,999    heading "Total Bytes"
column used    format 99,999,999,999   heading "Used"
column free    format 999,999,999,999 heading "Free"
break   on report
compute sum of bytes on report
compute sum of free on report
compute sum of used on report
set linesize 132
set termout off
select a.tablespace_name                                              name,
       b.tablespace_name                                              dummy,
       sum(b.bytes)/count( distinct a.file_id||'.'||a.block_id )      bytes,
       sum(b.bytes)/count( distinct a.file_id||'.'||a.block_id ) -
       sum(a.bytes)/count( distinct b.file_id )              used,
       sum(a.bytes)/count( distinct b.file_id )                       free,
       100 * ( (sum(b.bytes)/count( distinct a.file_id||'.'||a.block_id )) -
               (sum(a.bytes)/count( distinct b.file_id ) )) /
       (sum(b.bytes)/count( distinct a.file_id||'.'||a.block_id )) pct_used
from sys.dba_free_space a, sys.dba_data_files b
where a.tablespace_name = b.tablespace_name
group by a.tablespace_name, b.tablespace_name;
PROMPT
PROMPT ------------------------------------------------------------------------|
PROMPT
PROMPT
PROMPT Checking Size and usage in GB of Flash Recovery Area
PROMPT
SELECT
ROUND((A.SPACE_LIMIT / 1024 / 1024 / 1024), 2) AS FLASH_IN_GB,
ROUND((A.SPACE_USED / 1024 / 1024 / 1024), 2) AS FLASH_USED_IN_GB,
ROUND((A.SPACE_RECLAIMABLE / 1024 / 1024 / 1024), 2) AS FLASH_RECLAIMABLE_GB,
SUM(B.PERCENT_SPACE_USED) AS PERCENT_OF_SPACE_USED
FROM
V$RECOVERY_FILE_DEST A,
V$FLASH_RECOVERY_AREA_USAGE B
GROUP BY
SPACE_LIMIT,
SPACE_USED ,
SPACE_RECLAIMABLE ;
PROMPT
PROMPT ------------------------------------------------------------------------|
PROMPT
PROMPT
PROMPT Checking free space In Flash Recovery Area
PROMPT
column FILE_TYPE format a20
select * from v$flash_recovery_area_usage;
PROMPT
PROMPT ------------------------------------------------------------------------|
PROMPT
PROMPT
PROMPT ------------------------------------------------------------------------|
PROMPT
PROMPT
PROMPT Checking last sequence in v$archived_log
PROMPT
clear screen
set linesize 100
column STANDBY format a20
column applied format a10
--select max(sequence#), applied from v$archived_log where applied = 'YES' group by applied;
SELECT name as STANDBY, SEQUENCE#, applied, completion_time from v$archived_log WHERE DEST_ID = 2 AND NEXT_TIME > SYSDATE -1;
prompt
prompt----------------Last log on Primary--------------------------------------|
prompt
select max(sequence#) from v$archived_log where NEXT_TIME > sysdate -1;
PROMPT
PROMPT ------------------------------------------------------------------------|
PROMPT
PROMPT
PROMPT Checking switchover status
PROMPT
select switchover_status from v$database;I run it from a shell script and email myself quickaudit.lst
Alert logs are great source of information when you have an issue or just want to check something.
Best Regards
mseberg

Alert Log File Monitoring of 8i and 9i Databases with EM Grid Control 10g

Is it possible to monitor alert log errors in Oracle 8i/9i Databases with EM Grid Control 10g and EM 10g agents? If yes, is it possible to get some kind of notification?
I know that in 10g Database, it is possible to use server generated alerts, but what about 8i/9i?
Regards,
Martin

Hello
i am interested in a very special feature: is it possible to get notified if alerts occur in alert logs in an 8i/9i database when using Grid control and the 10g agent on the 8i/9i systems?
Moreover, the 10g agent should be able to get Performance Data using the v$ views or direct sga access without using statspack, right?
Do you know where I can find documentation about the supported features when using Grid Control with 8i/9i databases?

Metrics to monitor Alert Log

Hi,
I am trying to make modification in metric for monitoring alertlog.
When I try to add a new line,it's asking for field "Time/Line Number",any one know what should be the value for that?
Description on that page --> "The table lists all Time/Line Number objects monitored for this metric. You can specify different threshold settings for each Time/Line Number object." doesn''t make much sense to me.
I gave a dummy value 50,but it doesn't seem to work..
Any help is highly appreciated... thanks...

For monitoring <11g database note 976982.1 may be of use to you: https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&doctype=BULLETIN&id=976982.1;
For monitoring 11g db's see note 949858.1 (Monitoring 11g Database Alert Log Errors in Enterprise Manager)
I your case you may want to consider to create a UDM, see Monitor Non Critical 11g Database Alert Log Errors Using a SQL UDM [ID 961682.1]
Eric

Need help in creating a 'Generic txt log' monitor

Hi
We require some help in creating a 'Generic txt log' monitor.
In a txt-log a system is writing log-entries of a job.
When the job is running successfully, the entries is like this:
First line: CRM VISMA Import - Start of job execution
Second line: CRM VISMA Import - Job execution finished
When the job is NOT running successfully, the entries are like:
First line: CRM VISMA Import - Start of job execution
Second line <this could be anything>
So, how to we create a monitor that trigger an alert if
First line = "CRM VISMA Import - Start of job execution"
and second line is NOT "CRM VISMA Import - Job execution finished"
And closing the alert if the entries are once again gets:
First line: CRM VISMA Import - Start of job execution
Second line: CRM VISMA Import - Job execution finished
Thanks in advance
/Peter

You may consider using script monitor, below is the coding of script section:
Assumption: the file is stored in c:\temp\AppLog.txx. You should modify the file path for your own situation
Dim oAPI, oBag
dim strComputer, objWMIService, PerfProcess,Perf, PerfPro
Dim PerfMems,PerfMem,Mem
Set oAPI=CreateObect("MOM.ScriptAPI")
Set oBag=oAPI.CreatePropertyBag()
Set objFileToRead = CreateObject("Scripting.FileSystemObject").OpenTextFile("C:\temp\AppLog.txt",1)
Dim strLine,PreLine
Dim jobFail
JobFail=false
do while not objFileToRead.AtEndOfStream
strLine = objFileToRead.ReadLine()
if PreLine<>"" then
            if strLine<>"CRM VISMA Import - Job execution finished" then
               JobFail=true
            else
               JobFail=false
            end if
            PreLine=""
         end if
if strLine="CRM VISMA Import - Start of job execution" then
    PreLine=strLine
end if
loop
objFileToRead.Close
Set objFileToRead = Nothing
If JobFail then
Call oBag.AddValue("JobFail", "Yes")
else
Call oBag.AddValue("JobFail", "NO")
end if
Call OAPI.Reten(oBag)
Roger

Need to find the way to get the actual error message in the alert log.

Hi,
I have configured OEM 11G and monitoring target versions are from 9i to 11g. Now my problem is i have defined the metrics for monitoring the alert log contents and OEM is sending alert if there is any error in the alert log but it is not showing the actual error message just it is showing as below.
============================
Target Name=IDMPRD
Target type=Database Instance
Host=oidmprd01.ho.abc.com
Occurred At=Dec 21, 2011 12:05:21 AM GMT+03:00
Message=1 distinct types of ORA- errors have been found in the alert log.
Metric=Generic Alert Log Error Status
Metric value=1
Severity=Warning
Acknowledged=No
Notification Rule Name=RULE_4_PROD_DATABASES
Notification Rule Owner=SYSMAN
============================
Is there any way to get the complete error details in the OEM alert itself.
Regards
DBA.

You need to look at the Alert Log error messages, not the "status" messages. See doc http://docs.oracle.com/cd/E11857_01/em.111/e16285/oracle_database.htm#autoId2

How to be notified for all ORA- Errors recorded in the alert.log file

based on Note:405396.1, I Changed the Matches Warning from the default value ORA-0*(600?|7445|4[0-9][0-9][0-9])[^0-9] to ORA-* in order to receive an warning alert for all ORA- errors.
but I just recieved the alert like the following:
Metric=Generic Alert Log Error
Time/Line Number=Mon Feb 25 23:52:21 2008/21234
Timestamp=Feb 26, 2008 12:06:03 AM EST
Severity=Warning
Message=ORA-error stack (1654, 1654, 1654) logged in /opt/oracle/admin/PRD/bdump/alert_PRD.log.
Notification Rule Name=Alert Log Error
Notification Rule Owner=SYSMAN
as you can see, the message only indicate the ORA-1654, nothing else.
How to set in 10g grid control to get the details alert that in the alert log like:
"ORA-1654: unable to extend index ADM.RC_BP_STATUS by 1024 in tablespace PSINDEX"
I can't believe Oracle 10g Grid control only provide the ORA- number without details

Go to your database target.
On the home tab, on the left hand side under Diagnostic Summary, you'll see a clickable date link next to where it says 'Alert Log'. Click on that.
next click on Generic Alert Log Error Monitoring Configuration (its at the bottom)
In the alert thresholds put:
ORA-0*(600?|7445|4[0-9][0-9][0-9])[^0-9]
I believe that will pick anything up but experiment, its only perl.
If you want to test this use the DBMS_System.ksdwrt package but I would advise you only do so on a test database. If you've never heard of it, google it. Its a way of writing to your alert log.
Make sure you have your emails sent to long format as well.

Create custom rule: Looking for ORA errors in the alert log

I would like to create a rule to notify me when ORA errors are generated to the alert log. When I try to create a rule, I seem to only be able to choose from predefined lists. Has anyone configured a rule for this?

Grrr. This is for 10.2 Grid:
Go to databases --> select your database
Under Diagnostic summary, you'll see:
Alert Log 28-Dec-2006 09:19:48
The date part is a clickable link, click on it. Scroll to the bootom of the next page and click on:
"Generic Alert Log Error Monitoring Configuration"
Now read the page very carefully, its all self explanatory. The reason who haven't had some errors reported is because of that filter. Now set it up the way you want it.
Good luck
Bazzza

Not clearable : 1 distinct types of ORA- errors have been found in the alert log.

( Correct me if I'm wrong.)
What could be the reason for the fact that the event "1 distinct types of ORA- errors have been found in the alert log." is not clearable?
Even if the problem is solved, the ORA- error will still be in the alert.log.
Therefore the event would eventually only disappear after 7 days.
Doesn't sound very logical to me.

- The event page showing a warning event for "Generic Alert Log Error Status" metric,
- "Generic Alert Log Error Status" event is a statefull metric,
- On each evaluation of the metric defined as 'Statefull', the Cloud Control Agent recalculates the severity,
- This means, EM Agent scans the alert log for ORA errors, "Generic Alert Log Error Status" will return the number of ORA error found,
- Whenever the returned number is grater than the assigned thresholds of "Generic Alert Log Error Status", an alert is raised on EM console,
- On the next scan of alert log file, this alert will be cleared ONLY if the collected value is less than the assigned threshold,
- By checking your system, the warning threshold of "Generic Alert Log Error Status" is 0, so whenever a single ORA error is found in alert log, a warning event will be raised and you will not be able to clear it manually as this is a stateful metric.
There are three cases where this alert can be cleared:
1. The agent found 0 ORA errors in Alert log, then the alert will be cleared automatically
2. Manual clear: By disabling/enabling the metric
3. Manual clear and further not receiving similar alerts frequently: By assigning higher thresholds values
So, I suggest to disable the metric, then, enable it after some time as follows as follows:
- Go to the problematic database home page >> open the 'Oracle Database' drop-down menu >> 'Monitoring' >> 'Metric and Collection Settings',
- Choose 'All metrics' from the 'View' drop-down list >> search for the 'Generic Alert Log Error Status' metric,
- Click the pencil icon under 'Edit' column opposite to the above metric >> remove the Warning Threshold (make it empty) >> 'Continue' >> 'OK'.
- Wait for the next collection schedule in order for the warning events to be cleared, then, enable the metric again with the same steps (setting Warning Threshold=0).
References:
Note 604385.1 Receiving "Clear" Notifications Unexpectedly for 'Generic Alert Log Error Status' Metric
Note 733784.1 What are Statefull and Stateless Metrics in Enterprise Manager - Explanation and Example
HTH
Mani

Alert log.xml or alert.log errors do not appear in EM

Little puzzled here. Using 11.1.0.6 to test if alert errors will appear on 11.1.0.1 EM Grid pages. Simple ORA-1653 triggered via sql insert and then waited and waited. Nothing. I can use EM to open log file and to display the errors but no alerts are flagged on any of the pages.
Is this a another bug?
Roman

You can read all about how the 11g alert log is monitored in: Monitoring 11g Database Alert Log Errors in Enterprise Manager [ID 949858.1]
Yes, it describes some bugs (and workarounds) too.
Eric

Alert log monitoring in dbconsole 11.2.0.2.0

Similar Messages

Maybe you are looking for