[syslog-ng] Oracle logging into syslog-ng?
hpsekhon at googlemail.com
Mon Sep 8 10:28:22 CEST 2008
Alternatively you could have Oracle write to a standard
alert_instance.log file and then have that followed and inserted into
syslog-ng. There are 2 ways to do this:
1. You could use syslog-ng's ability to follow the individual instance
alert log files and then prefix all input from each file with an
instance name like Oracle_Instance1, Oracle_Instance2...
2. You could write a script to follow the individual alert log files and
input to syslog with whatever priority/facility you like and still have
every input tagged like program_instance: message before it even enters
syslog. This is what I did for Oracle 9i/10g instances I have since I
think that 9i doesn't have syslog capabilities... (although I could be
wrong on that)
Surlow, Jim wrote:
> Please provide thoughts and comments –
> I’m not a DBA and I’m having our DBAs do further research here, but …
> I infer from the Oracle documentation, that Oracle logs to a single
> syslog facility+level per instance, if configured. And the information
> in the Oracle log cannot be configured/altered. The downside that I’m
> seeing is that there is no information in regards to the Oracle
> instance. So, if I have a box with 20+ instances and I wish to relay
> this to a central server, all this is going to end up as noise.
> My kludge for this, would be to setup the following on each Oracle server:
> Instance #1 -> local0.debug
> Instance #2 -> local0.info
> Instance #3 -> local0.warn
> Instance #4 -> local1.debug
> Instance #5 -> local1.info
> Instance #6 -> local1.warn
> Then, setup syslog-ng on that Oracle server to use templates (one per
> instance), to route the data to a single facility & level on our
> centralized syslog-ng log server and imbed an instance name into the log.
> This config sounds really cumbersome. I’m also trying to avoid using
> Oracle to send the logs to a different instance which would do the
> consolidation. Does anyone else have a better solution? Am I right in
> that Oracle will only send to a single facility+level combo regardless
> of criticality?
More information about the syslog-ng