Create this type of source for collecting most types of logs, such as Database, Application, and Infrastructure logs.

1. Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.

   The administration resources are listed in the left hand navigation pane under Resources. Click Sources.

   The Sources page opens. Click Create Source.

2. In the Name field, enter the name of the source.

   Optionally, add a description.

3. From the Source Type list, select the type File.
4. Click the Entity Type field and select the type of entity for this log source. Select the entity type for your log source that most closely matches what you are going to monitor. Avoid selecting composite entity types, for example, Database Cluster. Instead select the entity type Database Instance because the logs are generated at the instance level.
5. Click the Parser field and select the relevant parser name.
   You can select multiple file parsers for the log files. This is particularly helpful when a log file has entries with different syntax and can’t be parsed by a single parser.

   The order in which you add the parsers is important. When Oracle Logging Analytics reads a log file, it tries the first parser and moves to the second parser if the first one does not work. This continues until a working parser is found. Select the most common parser first for this source.

   To parse only the time information from the log entries, you can select the automatic time parser. See Use the Automatic Time Parser.

6. Enter the following information in the Include and Exclude tabs:
   • In the Included Patterns tab, click Add to specify file name patterns for this source.

     Enter the file name pattern and description.

     You can enter parameters within braces {}, such as {AdrHome}, as a part of the file name pattern. Oracle Logging Analytics replaces these parameters in the include pattern with entity properties when the source is associated with an entity. The list of possible parameters is defined by the entity type. If you create your own entity types, you can define your own properties. When you create an entity, you will be prompted to give value for each property for that entity. You can also add your own custom properties per entity, if required. Any of these properties can be used as parameters here in the Included Patterns.

     For example for a given entity where {AdrHome} property is set to /u01/oracle/database/, the include pattern {AdrHome}/admin/logs/*.log will be replaced with /u01/oracle/database/admin/logs/*.log for this specific entity. Every other entity on the same host can have a different value for {AdrHome}, which would result in a completely different set of log files to be collected for each entity.

     You can associate a source with an entity only if the parameters that the source requires in the patterns has a value for the given entity.

     You can configure warnings in the log collection for your patterns. In the Send Warning drop-down list, select the situation in which the warning must be issued:

     • For each pattern that has an issue: When you have set multiple include patterns, a log collection warning will be sent for each file name pattern which doesn't match.

     • Only if all patterns have issues: When you have set multiple include patterns, a log collection warning will be sent only if all the file name patterns don't match.

   • You can use an excluded pattern when there are files in the same location that you don’t want to include in the source definition. In the Excluded Patterns tab, click Add to define patterns of log file names that must be excluded from this log source.

     For example, there’s a file with the name audit.aud in the directory that you configured as an include source (/u01/app/oracle/admin/rdbms/diag/trace/). In the same location, there’s another file with the name audit-1.aud. You can exclude any files with the pattern audit-*.aud.

7. Click Create Source.

You can use the Log Source field in the Fields panel of the Log Explorer in Oracle Logging Analytics to view syslog data.

1. In the Oracle Logging Analytics Log Explorer, click Source in the Fields panel.
2. In the Filter by Source dialog box, select name of the syslog source that you created, and click Apply.

Create the database entity to reference your database instance and to enable log collection from it. If you are using management agent to collect logs, then after you install the management agent, you must come back here to configure the agent monitoring for the entity.

1. Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.

2. The administration resources are listed in the left hand navigation pane under Resources. Click Entities.

3. Ensure that your compartment selector on the left indicates that you are in the desired compartment for this new entity.

   Click Create.

4. Select an Entity Type that suits your database instance, for example Oracle Database Instance.

   Provide a Name for the entity.

5. Select Management Agent Compartment in which the agent is installed and select the Management Agent to associate with the database entity so that the logs can be collected.

   Alternatively, you can create the entity first, edit it later and provide the management agent OCID after the agent is installed.

   Note
   
   

   • Monitoring of MySQL Database Instance and Microsoft SQL Server Database is supported only with the installation of standalone Management Agent. It is not supported with Management Agent plugin in Oracle Cloud Agent.

   • Use Management Agent version 210403.1350 or later to install on your database host to ensure Microsoft SQL Server Database support.

   • For successful log collection from MySQL Database Instance source, ensure that Management Agent version is 210205.0202 or later.

6. To ingest SQL, provide the following properties in case of Oracle Database Instance or Oracle Pluggable Database:

   • port
   • hostname
   • sid or service_name

     If you provide both the values, then Logging Analytics uses service_name to ingest SQL.

   For log collection from Microsoft SQL Server Database Instance and MySQL Database source, provide the following properties:

   • database_name
   • host_name
   • port

   If you intend to use Oracle-defined log sources to collect logs from management agents, it is recommended that you provide any parameter values that may already be defined for the chosen entity type. If the parameter values are not provided, then when you try to associate the source to this entity, it will fail because of the missing parameter values.

   Click Save.

If your database is enabled for Database Management and has a cloud resource OCID associated with it, then Logging Analytics enables you to view it in Database Management with the help of the option available in the Log Explorer.

To enable Database Management for your database, see OCI Documentation: Enable Database Management.

1. Open the navigation menu and click Observability & Management. Under Logging Analytics, click Log Explorer.

2. Search for your logs by entity type which must be one of the database types. In the Fields panel, under Pinned section, click Entity Type. In the Entity Type dialog box, select the required entity types, for example, Oracle Database Instance, and click Apply.

3. From the Visualize panel, select one of the visualization options that display the records table, for example, Records with Histogram.

   Then the logs are filtered by the entity type and displayed in the Records with Histogram visualization. In the records table, under each log record, the information about the entity name, log source, and entity type are displayed.

4. Click the name of the entity. From the menu, click View in Database Management.

A new tab with the Database Management service console in the context of your database is displayed.

Oracle Logging Analytics already provides several Oracle-defined log sources for Windows Event collection.

Oracle Logging Analytics already provides several Oracle-defined log sources for syslog collection. Check if you can use one of the available Oracle-defined or user-defined sources. If not, use the following steps to create a new log source:

1. Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.

   The administration resources are listed in the left hand navigation pane under Resources. Click Sources.

   The Sources page opens. Click Create Source.

2. In the Name field, enter the name of the source.

   Optionally, add a description.

3. From the Source Type list, select Microsoft Windows. With this option, all historic Windows Event Log entries as well as records from custom event channels can be collected.

   This source type does not require the field Log Parser. Also, the default entity type Host (Windows) is automatically selected, and cannot be changed.

4. Specify an event service channel name. The channel name must match with the name of the Windows event so that the agent can form the association to pick up logs.

5. To filter the Windows events with specific event IDs, add Data Filters. See Create Data Filters for Windows Event System Source.

6. Click Create Source.

To filter the Windows events with specific event IDs for Windows Event System source, follow these steps:

1. On the host where you installed the Management Agent, go to the location agent_inst\state\laStorage\os_wineventsystem\config. If the directory or path does not exist, create it.

2. Create a user properties file dataFilter.properties. To this file, add all the Windows event IDs in the following format:

   <channel>.dropEvent.eventID=<id1>
   <channel>.dropEvent.eventID=<id2>
   <channel>.dropEvent.eventID=<id3>

   For example,

   Security.dropEvent.eventID=4624
   Security.dropEvent.eventID=4672
   Security.dropEvent.eventID=4673

3. Restart the Management Agent.

Sources define the location of your entity's logs and how to enrich the log entries. To start continuous log collection through the OCI management agents, a source needs to be associated with one or more entities.

1. Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.

   The administration resources are listed in the left hand navigation pane under Resources. Click Sources.

   The Sources page opens. Click Create Source.

2. In the Name field, enter the name of the source.

   Optionally, add a description.

3. From the Source Type list, select the type Oracle Diagnostic Logging (ODL).

   Use this type for logs that follow the Oracle Diagnostics Logs format. These are typically used for diagnostic logs for Oracle Fusion Middleware and Oracle Applications.

4. Click the Entity Type field and select the type of entity for this log source. Select the entity type for your log source that most closely matches what you are going to monitor. Avoid selecting composite entity types, for example, Database Cluster. Instead select the entity type Database Instance because the logs are generated at the instance level.
5. Click the Parser field and select the relevant parser name. For ODL source type, the only parser available is Oracle Diagnostic Logging Format.
6. In the Include and Exclude tabs, enter the following information:
   • In the Included Patterns tab, click Add to specify file name patterns for this source.

     Enter the file name pattern and description.

     You can enter parameters within braces {}, such as {AdrHome}, as a part of the file name pattern. Oracle Logging Analytics replaces these parameters in the include pattern with entity properties when the source is associated with an entity. The list of possible parameters is defined by the entity type. If you create your own entity types, you can define your own properties. When you create an entity, you will be prompted to give value for each property for that entity. You can also add your own custom properties per entity, if required. Any of these properties can be used as parameters here in the Included Patterns.

     For example for a given entity where {AdrHome} property is set to /u01/oracle/database/, the include pattern {AdrHome}/admin/logs/*.log will be replaced with /u01/oracle/database/admin/logs/*.log for this specific entity. Every other entity on the same host can have a different value for {AdrHome}, which would result in a completely different set of log files to be collected for each entity.

     You can associate a source with an entity only if the parameters that the source requires in the patterns has a value for the given entity.

     You can configure warnings in the log collection for your patterns. In the Send Warning drop-down list, select the situation in which the warning must be issued:

     • For each pattern that has an issue: When you have set multiple include patterns, a log collection warning will be sent for each file name pattern which doesn't match.

     • Only if all patterns have issues: When you have set multiple include patterns, a log collection warning will be sent only if all the file name patterns don't match.

   • You can use an excluded pattern when there are files in the same location that you don’t want to include in the source definition. In the Excluded Patterns tab, click Add to define patterns of log file names that must be excluded from this log source.

     For example, there’s a file with the name audit.aud in the directory that you configured as an include source (/u01/app/oracle/admin/rdbms/diag/trace/). In the same location, there’s another file with the name audit-1.aud. You can exclude any files with the pattern audit-*.aud.

7. Click Create Source.