Monitoring messages in Oracle alert log

Body

This is a brief discussion of monitoring of alert log messages using ITCAM Extended Oracle Agent.

Hopefully you will be able to answer following questions after reading this entry.

            How can the agent be used to get an alert when specific message ID appears in the alert log?

            Why are some messages in Oracle alert log not being displayed by the agent?

           How can the message IDs monitored by Oracle agent be customized?

1) Alert message IDs pattern specification

Agent reads a message ID pattern file specified for the Oracle agent instance, and uses it to filter messages seen in alert log.
The message ID pattern file is created in agent's  ITM/config directory, it is named <host>_rz_<instance>_msgid.properties.

The default msgid properties file is installed in <ITMHOME>/<arch>/bin/krzmsgid.properties - for example: /opt/IBM/ITM/li6263/rz/bin/krzmsgid.properties
A copy of this file is created for each configured Oracle agent instance when the agent starts. (see ***Note below)

This instance specific file can be customized for each agent instance.

For example:

ORA-0*204=1

The setting =1 means severity of 'Error', =2 means 'Warning' etc. The setting of =5 is special, it means that the message is to be ignored or 'filtered out' as opposed to 'filtered in' as for other settings.

Read the header information in the pattern file for other severity settings.

***Note: If you want to modify the msgid file for all Oracle agent instances in an installation directory, then instead of modifying individual msgid files for the instances, you can modify the <ITMHOME>/<arch>/bin/krzmsgid.properties file, then delete the config/<host>_rz_<instance>_msgid.properties files and restart the Oracle agent instances. This will recreate the msgid files for the instances using the modified template in <ITMHOME>/<arch>/bin/krzmsgid.properties.

2) Alert Log workspace

When a message is 'filtered in' by the agent, it is displayed in Alert Log workspace of the agent.
Suppose message ID ORA-00445 occurs in alert log of monitored instance. The msgid.propertieshas following matching pattern. The '=1' means that a severity of 'Error' is assigned to the pattern.
ORA-0*44[0-9]=1

The message ORA-00445 is displayed in TEP workspace Alert Log, under the Alert Log Detail view, with Severity Level set to 'Error'.

3) Customizing msgid.properties file

Suppose if you want to monitor message ID ORA-3297. The msgid.properties file does not contain a matching pattern.
Edit the <host>_rz_<instance>_msgid.properties file to add following line to start monitoring ORA-3297 with severity of 'Error'. The agent will start monitoring this message.
ORA-3297=1

4) Attributes to use in situations

The attribute group KRZ_RDB_ALERT_LOG_DETAILS contains two attributes which uniquely identify the message, the numeric attribute Message_Number, and string attribute Message_ID.

As an example, consider that you want to get an alert for all ORA-3* message IDs, except when the number is 3214 and 3296. Use following steps to implement this monitoring.

Add the following pattern in <host>_rz_<instance>_msgid.properties file:
ORA-3*=1

Next, create a situation with following formula based on RDB Alert Log Details attribute group :

( SCAN(Message ID) == 'ORA-3' AND Message Number != 3214 AND Message Number != 3296)

Additional information:

Customizing Oracle alert log monitoring

Agent is alerting on old message in the alert log

Situation for alert log monitoring