elastic / elastic/beats

Filebeat Oracle module doesn't support alert log

Open
#34,056 6 comments 3 reactions 0 assignees View on GitHub
Stalled Team:Obs-InfraObs
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

**Describe the enhancement:**

Alert logs contain important information about error messages and exceptions that occur during database operations.

Now oracle module supports only aud files. Please add support for alert_XXX.log where XXX=SID.

Oracle will write the alert.log file to the directory as specified by the _BACKGROUND_DUMP_DEST_ parameter. If this parameter is not set, the alert.log will be created in a directory below the value of the _DIAGNOSTIC_DEST_ parameter: _DIAGNOSTIC_DEST_/diag/rdbms/DB_NAME/ORACLE_SID/trace. If this later parameter is not set, the alert.log file is created in the _ORACLE_HOME_/rdbms/trace directory.

```
SQL> show parameter BACKGROUND_DUMP_DEST

NAME TYPE VALUE
------------------------------------ ----------- ------------------------------------------
background_dump_dest string /app/oracle/diag/rdbms/o11gr1/o11gr1/trace
```

**Describe a specific use case for the enhancement or feature:**

We collect oracle alert log using the following config:

```
- type: log
enabled: true
paths:
- /oracle/diag/rdbms/*/*/trace/alert_*.log
multiline.pattern: '^[A-Za-z]{3}\s+[A-Za-z]{3}\s+[0-9]{1,2}\s[0-9]{2}:[0-9]{2}:[0-9]{2}\s[0-9]{4}'
multiline.negate: true
multiline.match: after
multiline.timeout: 10
```

Contributor guide

Open the contributing guide

Research direction

The payload names no repository files or tests; start by locating the existing Filebeat Oracle module and its audit-file configuration. Compare its current path and multiline handling with the requested alert_XXX.log pattern, and consider the issue complete when Oracle alert logs are collected with the described multiline behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, sql
Domain
databases, observability-sre
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.