[syslog-ng] Oracle logging into syslog-ng?

[Hari Sekhon]

Hi Jim,

Alternatively you could have Oracle write to a standard 
alert_instance.log file and then have that followed and inserted into 
syslog-ng. There are 2 ways to do this:

1. You could use syslog-ng's ability to follow the individual instance 
alert log files and then prefix all input from each file with an 
instance name like Oracle_Instance1, Oracle_Instance2...
2. You could write a script to follow the individual alert log files and 
input to syslog with whatever priority/facility you like and still have 
every input tagged like program_instance: message before it even enters 
syslog. This is what I did for Oracle 9i/10g instances I have since I 
think that 9i doesn't have syslog capabilities... (although I could be 
wrong on that)

-h

Surlow, Jim wrote:
>
> Please provide thoughts and comments –
>
> I’m not a DBA and I’m having our DBAs do further research here, but …
>
> I infer from the Oracle documentation, that Oracle logs to a single 
> syslog facility+level per instance, if configured. And the information 
> in the Oracle log cannot be configured/altered. The downside that I’m 
> seeing is that there is no information in regards to the Oracle 
> instance. So, if I have a box with 20+ instances and I wish to relay 
> this to a central server, all this is going to end up as noise.
>
> My kludge for this, would be to setup the following on each Oracle server:
>
> Instance #1 -> local0.debug
>
> Instance #2 -> local0.info
>
> Instance #3 -> local0.warn
>
> Instance #4 -> local1.debug
>
> Instance #5 -> local1.info
>
> Instance #6 -> local1.warn
>
> Etc.
>
> Then, setup syslog-ng on that Oracle server to use templates (one per 
> instance), to route the data to a single facility & level on our 
> centralized syslog-ng log server and imbed an instance name into the log.
>
> This config sounds really cumbersome. I’m also trying to avoid using 
> Oracle to send the logs to a different instance which would do the 
> consolidation. Does anyone else have a better solution? Am I right in 
> that Oracle will only send to a single facility+level combo regardless 
> of criticality?
>
> Thanks,
>
> Jim
>


-- 
Hari Sekhon