Splunk® Supported Add-ons

Splunk Add-on for Oracle Database

Source types for the Splunk Add-on for Oracle Database

The Splunk Add-on for Oracle Database collects different logs and events from different sources in Oracle Database Server. The add-on assigns different source types for each different log or event source.

There are two major groups of source types for the Splunk Add-on for Oracle Database. Each group depends on how events are collected:

  • Collected through file monitoring (based on log files)
  • Collected through Splunk DB Connect (based on database entries)

Log file source types

Many Oracle log files offer the option of a plain text format or an XML format. You can choose to configure the logs in either of these formats because this add-on supports field extractions for both formats. In general, XML-formatted logs have more verbose information and are easier to parse, but may occupy more OS disk space.

You can customize the location and name of most log files in Oracle. The table below provides the default location for each log file and a query that you can run in case the location has changed.

More information about the different log and event data supported by this add-on is available below the table.

All listed source types based on log files are for Oracle Versions 11g/12.1/12.2/19c/21c

Log/
Event
Log Format Source Type Default File Location CIM Data Model
Audit Log Plain text oracle:audit:text $ORACLE_BASE/admin/$ORACLE_SID/adump/*.aud

Query this location by issuing show parameter AUDIT_FILE_DEST;
Authentication, Databases,

Change

XML oracle:audit:xml $ORACLE_BASE/admin/$ORACLE_SID/adump/*.xml

Query this location by issuing show parameter AUDIT_FILE_DEST;
Databases,Authentication,

Change

Alert Log Plain text oracle:alert:text $ORACLE_BASE/diag/rdbms/$ORACLE_SID/$ORACLE_SID/ trace/alert_$ORACLE_SID.log

Query this location by issuing select value from v$diag_info where name = 'Diag Trace';

N/A
XML oracle:alert:xml $ORACLE_BASE/diag/rdbms/$ORACLE_SID/$ORACLE_SID/ alert/log.xml

Query this location by issuing select value from v$diag_info where name = 'Diag Alert';

N/A
Listener Log Plain text oracle:listener:text $ORACLE_BASE/product/db_1/network/log/listener.log
For 21c:


$ORACLE_BASE/diag/tnslsnr/$HOST_NAME/listener/trace/listener.log

Query this location by running lsnrctl status

N/A
XML oracle:listener:xml $ORACLE_BASE/diag/tnslsnr/$HOST_NAME/listener/ alert/log.xml

Query this location by running lsnrctl status

N/A
Incident log Plain text oracle:incident $ORACLE_BASE/diag/rdbms/$ORACLE_SID/$ORACLE_SID/ incident/*/*.trc

Query this location by issuing select value from v$diag_info where name = 'Diag Incident';

N/A
Trace log Plain text oracle:trace For 10g:
$ORACLE_HOME/admin/$ORACLE_SID/ udump/*.trc

For 11g/12c:
$ORACLE_HOME/diag/rdbms/$ORACLE_SID/ $ORACLE_SID/trace
For 21c: $ORACLE_BASE/homes/OraDB21Home1/rdbms/log/*.trc

Query this location by issuing show parameter USER_DUMP_DEST;

N/A

Database entry source types

Collect the following metrics using Splunk DB Connect.

The source types are based on specific database tables or views to get essential type of data (eg. V$SESSION or DBA_TABLESPACES to get session or tablespace information). Additional tables or views may be involved to collect more detail information (eg. beside V$SESSION, V$INSTANCE to build oracle:session events) or for other reasons (eg. DUAL for oracle:sga).

Date columns or current date (index time) can be used to define event timestamp.

Tables/views that contain data for current state are used to collect data in batches. Events from tables/views that contain historical or dynamic data are collected in rising mode. Date columns are used to define checkpoint for incremental load.

Object Oracle Version Source Type Tables/Views Time Mode CIM Data Model
Database 11g/12.1/12.2/19c/21c oracle:database V$DATABASE current batch Databases
Instance 11g/12.1/12.2/19c/21c oracle:instance V$INSTANCE

NLS_DATABASE_PARAMETERS

current batch Databases
Session 11g/12.1/12.2/19c/21c oracle:session V$SESSION

V$INSTANCE

current batch Databases
Tablespace 11g/12.1/12.2/19c/21c oracle:tablespace DBA_TABLESPACES
current batch N/A
Tablespace Metrics 11g/12.1/12.2/19c/21c oracle:tablespaceMetrics V$TEMP_SPACE_HEADER

V$TEMP_EXTENT_POOL
DBA_TEMP_FILES
DBA_FREE_SPACE
DBA_DATA_FILES

current batch Databases
System Global Area (SGA) 11g/12.1/12.2/19c/21c oracle:sga V$SGA

V$SGASTAT
V$PGASTAT
DUAL

current batch Databases
Cache 11g/12.1/12.2/19c/21c oracle:libraryCachePerf V$LIBRARYCACHE
current batch N/A
I/O performance 11g/12.1/12.2/19c/21c oracle:dbFileIoPerf V$FILESTAT

V$TEMPFILE
V$DATAFILE

current batch N/A
Host performance 11g/12.1/12.2/19c/21c oracle:osPerf V$OSSTAT
current batch N/A
System performance 11g/12.1/12.2/19c/21c oracle:sysPerf V$SYSMETRIC_HISTORY

V$INSTANCE

current rising by V$SYSMETRIC_HISTORY.END_TIME Databases
Connections performance 11g/12.1/12.2/19c/21c oracle:connections V$SESSION

V$INSTANCE

current batch Databases
Connections pool performance 11g/12.1/12.2/19c/21c oracle:pool:connections DBA_CPOOL_INFO

V$INSTANCE

current batch Databases
Table 11g/12.1/12.2/19c/21c oracle:table ALL_TABLES

ALL_TAB_MODIFICATIONS
DBA_SEGMENTS
V$INSTANCE

current batch Databases
Database size 11g/12.1/12.2/19c/21c oracle:database:size V$DATAFILE

V$INSTANCE

current batch Databases
User 11g/12.1/12.2/19c/21c oracle:user ALL_USERS

V$INSTANCE

current batch Databases
Queries performance 11g/12.1/12.2/19c/21c oracle:query V$SQLAREA

ALL_USERS
V$INSTANCE

current batch Databases
Unified Auditing Log 11g/12.1/12.2/19c/21c oracle:audit:unified UNIFIED_AUDIT_TRAIL

ALL_TAB_COLUMNS

UNIFIED_AUDIT_TRAIL.EVENT_TIMESTAMP_UTC rising by UNIFIED_AUDIT_TRAIL.EVENT_TIMESTAMP_UTC Authentication, Change
SQL Monitor 19c/21c oracle:sqlMonitor V$SQL_MONITOR

V$SQL_PLAN_MONITOR
V$SQLAREA
DBA_HIST_ACTIVE_SESS_HISTORY
V$INSTANCE
V$DATABASE
V$VERSION

V$SQL_MONITOR.SQL_EXEC_START rising by V$SQL_MONITOR.SQL_EXEC_START Databases
Connections pool statistics 12.2/19c/21c oracle:connections:poolStats V$INSTANCE

DBA_CPOOL_INFO
V$CPOOL_STATS
V$VERSION

current batch Databases
Last modified on 22 April, 2022
About the Splunk Add-on for Oracle Database   Release notes for the Splunk Add-on for Oracle Database

This documentation applies to the following versions of Splunk® Supported Add-ons: released


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters