Ingest Application, Infrastructure, Database and Other Generic Logs

Create this type of source for collecting most types of logs, such as Database, Application, and Infrastructure logs.

1. Open the navigation menu and click Observability & Management. Under Log Analytics, click Administration.

   The administration resources are listed in the left hand navigation pane under Administration. Click Sources.

   The Sources page opens. Click Create Source.

2. In the Name field, enter the name of the source.

   Optionally, add a description.

3. From the Source Type list, select the type File.
4. Click the Entity Type field and select the type of entity for this log source. Select the entity type for your log source that most closely matches what you are going to monitor. Avoid selecting composite entity types, for example, Database Cluster. Instead select the entity type Database Instance because the logs are generated at the instance level.
5. Click the Parser field and select the relevant parser name.
   You can select multiple file parsers for the log files. This is particularly helpful when a log file has entries with different syntax and can’t be parsed by a single parser.

   The order in which you add the parsers is important. When Oracle Log Analytics reads a log file, it tries the first parser and moves to the second parser if the first one does not work. This continues until a working parser is found. Select the most common parser first for this source.

   To parse only the time information from the log entries, you can select the automatic time parser. See Use the Automatic Time Parser.

6. Enter the following information in the Include and Exclude tabs:
   • In the Included Patterns tab, click Add to specify file name patterns for this source.

     Enter the file name pattern and description.

     You can enter parameters within braces {}, such as {AdrHome}, as a part of the file name pattern. Oracle Log Analytics replaces these parameters in the include pattern with entity properties when the source is associated with an entity. The list of possible parameters is defined by the entity type. If you create your own entity types, you can define your own properties. When you create an entity, you will be prompted to give value for each property for that entity. You can also add your own custom properties per entity, if required. Any of these properties can be used as parameters here in the Included Patterns.

     For example for a given entity where {AdrHome} property is set to /u01/oracle/database/, the include pattern {AdrHome}/admin/logs/*.log will be replaced with /u01/oracle/database/admin/logs/*.log for this specific entity. Every other entity on the same host can have a different value for {AdrHome}, which would result in a completely different set of log files to be collected for each entity.

     You can associate a source with an entity only if the parameters that the source requires in the patterns has a value for the given entity.

     You can configure warnings in the log collection for your patterns. In the Send Warning drop-down list, select the situation in which the warning must be issued:

     • For each pattern that has an issue: When you have set multiple include patterns, a log collection warning will be sent for each file name pattern which doesn't match.

     • Only if all patterns have issues: When you have set multiple include patterns, a log collection warning will be sent only if all the file name patterns don't match.

   • You can use an excluded pattern when there are files in the same location that you don’t want to include in the source definition. In the Excluded Patterns tab, click Add to define patterns of log file names that must be excluded from this log source.

     For example, there’s a file with the name audit.aud in the directory that you configured as an include source (/u01/app/oracle/admin/rdbms/diag/trace/). In the same location, there’s another file with the name audit-1.aud. You can exclude any files with the pattern audit-*.aud.

7. Click Create Source.