crsctl query calog

Query the cluster resource activity logs matching specific criteria.

Syntax

crsctl query calog 
[-aftertime "timestamp"] 
[-beforetime "timestamp"] 
[-days "number_of_days"] 
[-duration "time_interval" | -follow] 
[-filter "filter_expression"] 
[-processname "writer_process"] 
[-processid "writer_process_id"] 
[-node "entity_hostname"] 
[-fullfmt | -xmlfmt]

Parameters

crsctl query calog Command Parameters

-aftertime "timestamp": Displays the activities logged after a specific time.
Specify the timestamp in the YYYY-MM-DD HH24:MI:SS[.FF][TZH:TZM], YYYY-MM-DD, YYYY-MM, YYYY, or HH24:MI:SS[.FF][TZH:TZM] format.
TZH and TZM represent the time zone hour and minute, and FF represents microseconds.
If you specify [TZH:TZM], the crsctl command assumes UTC as the time zone. If you do not specify [TZH:TZM], the crsctl command assumes the local time zone of the cluster node from which the crsctl command is run.
Use this parameter with -beforetime to query activities logged within a specific time interval.
-beforetime "timestamp": Displays the activities logged before a specific time.
Specify the timestamp in the YYYY-MM-DD HH24:MI:SS[.FF][TZH:TZM], YYYY-MM-DD, YYYY-MM, YYYY, or HH24:MI:SS[.FF][TZH:TZM] format.
TZH and TZM represent the time zone hour and minute, and FF represents microseconds.
If you specify [TZH:TZM], the crsctl command assumes UTC as the time zone. If you do not specify [TZH:TZM], the crsctl command assumes the local time zone of the cluster node from which the crsctl command is run.
Use this parameter with -aftertime to query activities logged within a specific time interval.
-days "number_of_days": Displays the activities logged in the last number of days specified. Specify the number of days as an integer.
-duration "time_interval" | -follow: Use -duration to specify a time interval to query when using the -aftertime parameter.
Specify the time interval in the DD HH:MM:SS format.
Use -follow to display a continuous stream of activities as they occur.
-filter "filter_expression": Queries any number of fields in the cluster resource activity log.
To specify multiple filters, use a comma-delimited list of filter expressions enclosed in double quotation marks ("").
-processname "writer_process": Displays the activities logged by a specific process identified by name.
-processid "writer_process_id": Displays the activities logged by a specific process identified by ID.
-node "entity_hostname": Displays the activities logged by a specific host.
-fullfmt | -xmlfmt: Displays cluster resource activity log data in full or XML format.

Cluster Resource Activity Log Fields

Query any number of fields in the cluster resource activity log using the -filter parameter.

timestamp
- Description: The time when the cluster resource activities were logged.
- Use Case: Query all the activities logged at a specific time. This is an alternative to the -aftertime, -beforetime, and -duration command parameters.
writer_process_id
- Description: The ID of the process that is writing to the cluster resource activity log.
- Use Case: Query only the activities spawned by a specific process.
writer_process_name
- Description: The name of the process that is writing to the cluster resource activity log.
- Use Case: Query a specific process. CRSCTL returns all the activities for the specified process.
writer_user
- Description: The name of the user who is writing to the cluster resource activity log.
- Use Case: Query all the activities written by a specific user.
writer_group
- Description: The name of the group to which a user who is writing to the cluster resource activity log belongs.
- Use Case: Query all the activities written by users belonging to a specific user group.
writer_hostname
- Description: The name of the host on which the cluster resource activity log is written.
- Use Case: Query all the activities written by a specific host.
writer_clustername
- Description: The name of the cluster on which the cluster resource activity log is written.
- Use Case: Query all the activities written by a specific cluster.
nls_product
- Description: The product of the NLS message, for example, CRS, ORA, or srvm.
- Use Case: Query all the activities that have a specific product name.
nls_facility
- Description: The facility of the NLS message, for example, CRS or PROC.
- Use Case: Query all the activities that have a specific facility name.
nls_id
- Description: The ID of the NLS message, for example, 42008.
- Use Case: Query all the activities that have a specific message ID.
nls_field_count
- Description: The number of fields in the NLS message.
- Use Case: Query all the activities that correspond to NLS messages with more than, less than, or equal to the specified nls_field_count value.
nls_field1
- Description: The first field of the NLS message.
- Use Case: Query all the activities that match the first parameter of an NLS message.
nls_field1_type
- Description: The type of the first field in the NLS message.
- Use Case: Query all the activities that match a specific type of the first parameter of an NLS message.
nls_format
- Description: The format of the NLS message, for example, Resource '%s' has been modified.
- Use Case: Query all the activities that match a specific NLS message format.
nls_message
- Description: The entire NLS message written to the cluster resource activity log, for example, Resource 'ora.cvu' has been modified.
- Use Case: Query all the activities that match a specific NLS message.
actid
- Description: The unique activity ID of each cluster activity log entry.
- Use Case: Query all the activities that match a specific activity ID. You can also specify a partial actid to list activities where the specified value is a subset of the activity ID.
is_planned
- Description: Indicates whether an activity is planned.
  For example, if a user runs crsctl stop crs on a node, the stack stops and resources bounce. The command generates activities that are logged in calog. Because this is a planned action, is_planned is set to true (1). Otherwise, is_planned is set to false (0).
- Use Case: Query all planned or unplanned activities.
onbehalfof_user
- Description: The name of the user on whose behalf the cluster activity log is written.
- Use Case: Query all the activities written on behalf of a specific user.
entity_isoraentity
- Description: Indicates whether the entity for which calog activities are logged is an Oracle entity.
  For example, when a resource such as ora.*** is started or stopped, the corresponding activities are logged in the cluster resource activity log. Because ora.*** is an Oracle entity, entity_isoraentity is set to true (1). Otherwise, it is set to false (0).
- Use Case: Query all the activities logged by Oracle or non-Oracle entities.
entity_type
- Description: The type of entity, such as server, for which the cluster activity log is written.
  Entity types that you can use to filter activities include:
  - resource
  - resource_type
  - resource_group
  - server_category
  - ohasd — Activities generated by ohasd and the resources it manages.
  - crsd — Activities generated by crsd and the resources it manages.
  Oracle Grid Infrastructure components can also use their own entity names when writing to the activity log.
- Use Case: Query all the activities that match a specific entity type.
entity_name
- Description: The name of the entity, for example, foo, for which the cluster activity log is written.
- Use Case: Query all the cluster activities that match a specific entity name.
entity_hostname
- Description: The name of the host, for example, node1, associated with the entity for which the cluster activity log is written.
- Use Case: Query all the cluster activities that match a specific host name.
entity_clustername
- Description: The name of the cluster, for example, cluster1, associated with the entity for which the cluster activity log is written.
- Use Case: Query all the cluster activities that match a specific cluster name.

Usage Notes

Combine simple filters into expressions called expression filters using Boolean operators.
Enclose timestamps and time intervals in double quotation marks ("").
Enclose the filter expressions in double quotation marks ("").
Enclose the values that contain parentheses or spaces in single quotation marks ('').
If no matching records are found, then the Oracle Clusterware Control (CRSCTL) utility displays the following message:
```
CRS-40002: No activities match the query.
```

Examples

Examples of filters include:

"writer_user==root": Limits the display to only root user.
"customer_data=='GEN_RESTART@SERVERNAME(rwsbi08)=StartCompleted~'" : Limits the display to customer_data that has the specified value GEN_RESTART@SERVERNAME(node1)=StartCompleted~.

To query all the resource activities and display the output in full format:

$ crsctl query calog -fullfmt

----ACTIVITY START----
timestamp               : 2016-09-27 17:55:43.152000
writer_process_id       : 6538
writer_process_name     : crsd.bin
writer_user             : root
writer_group            : root
writer_hostname         : node1
writer_clustername      : cluster1-mb1
customer_data           : CHECK_RESULTS=-408040060~
nls_product             : CRS
nls_facility            : CRS
nls_id                  : 2938
nls_field_count         : 1
nls_field1              : ora.cvu
nls_field1_type         : 25
nls_field1_len          : 0
nls_format              : Resource '%s' has been modified.
nls_message             : Resource 'ora.cvu' has been modified.
actid                   : 14732093665106538/1816699/1
is_planned              : 1
onbehalfof_user         : grid
onbehalfof_hostname     : node1
entity_isoraentity      : 1
entity_type             : resource
entity_name             : ora.cvu
entity_hostname         : node1
entity_clustername      : cluster1-mb1
nls_severity            : INFO
----ACTIVITY END----

To query all the resource activities and display the output in XML format:

$ crsctl query calog -xmlfmt

<?xml version="1.0" encoding="UTF-8"?>
<activities>
  <activity>
    <timestamp>2016-09-27 17:55:43.152000</timestamp>
    <writer_process_id>6538</writer_process_id>
    <writer_process_name>crsd.bin</writer_process_name>
    <writer_user>root</writer_user>
    <writer_group>root</writer_group>
    <writer_hostname>node1</writer_hostname>
    <writer_clustername>cluster1-mb1</writer_clustername>
    <customer_data>CHECK_RESULTS=-408040060~</customer_data>
    <nls_product>CRS</nls_product>
    <nls_facility>CRS</nls_facility>
    <nls_id>2938</nls_id>
    <nls_field_count>1</nls_field_count>
    <nls_field1>ora.cvu</nls_field1>
    <nls_field1_type>25</nls_field1_type>
    <nls_field1_len>0</nls_field1_len>
    <nls_format>Resource '%s' has been modified.</nls_format>
    <nls_message>Resource 'ora.cvu' has been modified.</nls_message>
    <actid>14732093665106538/1816699/1</actid>
    <is_planned>1</is_planned>
    <onbehalfof_user>grid</onbehalfof_user>
    <onbehalfof_hostname>node1</onbehalfof_hostname>
    <entity_isoraentity>1</entity_isoraentity>
    <entity_type>resource</entity_type>
    <entity_name>ora.cvu</entity_name>
    <entity_hostname>node1</entity_hostname>
    <entity_clustername>cluster1-mb1</entity_clustername>
    <nls_severity>INFO</nls_severity>
  </activity>
</activities>

To query resource activities for a two-hour interval after a specific time and display the output in XML format:

$ crsctl query calog -aftertime "2016-09-28 17:55:43" -duration "0 02:00:00" -xmlfmt
<?xml version="1.0" encoding="UTF-8"?>
<activities>
  <activity>
    <timestamp>2016-09-28 17:55:45.992000</timestamp>
    <writer_process_id>6538</writer_process_id>
    <writer_process_name>crsd.bin</writer_process_name>
    <writer_user>root</writer_user>
    <writer_group>root</writer_group>
    <writer_hostname>node1</writer_hostname>
    <writer_clustername>cluster1-mb1</writer_clustername>
    <customer_data>CHECK_RESULTS=1718139884~</customer_data>
    <nls_product>CRS</nls_product>
    <nls_facility>CRS</nls_facility>
    <nls_id>2938</nls_id>
    <nls_field_count>1</nls_field_count>
    <nls_field1>ora.cvu</nls_field1>
    <nls_field1_type>25</nls_field1_type>
    <nls_field1_len>0</nls_field1_len>
    <nls_format>Resource '%s' has been modified.</nls_format>
    <nls_message>Resource 'ora.cvu' has been modified.</nls_message>
    <actid>14732093665106538/1942009/1</actid>
    <is_planned>1</is_planned>
    <onbehalfof_user>grid</onbehalfof_user>
    <onbehalfof_hostname>node1</onbehalfof_hostname>
    <entity_isoraentity>1</entity_isoraentity>
    <entity_type>resource</entity_type>
    <entity_name>ora.cvu</entity_name>
    <entity_hostname>node1</entity_hostname>
    <entity_clustername>cluster1-mb1</entity_clustername>
    <nls_severity>INFO</nls_severity>
  </activity>
</activities>

To query resource activities at a specific time:

$ crsctl query calog -filter "timestamp=='2016-09-28 17:55:45.992000'"

2016-09-28 17:55:45.992000 : node1 : INFO : Resource 'ora.cvu' has been modified. : 14732093665106538/1942009/1 :

To query resource activities using filters writer_user and customer_data:

$ crsctl query calog -filter "writer_user==root AND customer_data=='GEN_RESTART@SERVERNAME(node1)=StartCompleted~'" -fullfmt

$ crsctl query calog -filter "(writer_user==root) AND (customer_data=='GEN_RESTART@SERVERNAME(node1)=StartCompleted~')" -fullfmt

----ACTIVITY START----
timestamp               : 2016-09-15 17:42:57.517000
writer_process_id       : 6538
writer_process_name     : crsd.bin
writer_user             : root
writer_group            : root
writer_hostname         : node1
writer_clustername      : cluster1-mb1
customer_data           : GEN_RESTART@SERVERNAME(rwsbi08)=StartCompleted~
nls_product             : CRS
nls_facility            : CRS
nls_id                  : 2938
nls_field_count         : 1
nls_field1              : ora.testdb.db
nls_field1_type         : 25
nls_field1_len          : 0
nls_format              : Resource '%s' has been modified.
nls_message             : Resource 'ora.devdb.db' has been modified.
actid                   : 14732093665106538/659678/1
is_planned              : 1
onbehalfof_user         : oracle
onbehalfof_hostname     : node1
entity_isoraentity      : 1
entity_type             : resource
entity_name             : ora.testdb.db
entity_hostname         : node1
entity_clustername      : cluster1-mb1
nls_severity            : INFO
----ACTIVITY END----

To query all the calogs that were generated after UTC+08:00 time "2016-11-15 22:53:08":

$ crsctl query calog -aftertime "2016-11-15 22:53:08+08:00"

To query all the calogs that were generated after UTC-08:00 time "2016-11-15 22:53:08":

$ crsctl query calog -aftertime "2016-11-15 22:53:08-08:00"

To query all the calogs by specifying the timestamp with microseconds:

$ crsctl query calog -aftertime "2016-11-16 01:07:53.063000"
2016-11-16 01:07:53.558000 : node1 : INFO : Resource 'ora.cvu' has been modified. : 14792791129816600/2580/7 :
2016-11-16 01:07:53.562000 : node2 : INFO : Clean of 'ora.cvu' on 'node2' succeeded : 14792791129816600/2580/8 :

To query all the activities that were written by a specific process by name:

$  crsctl query calog -processname crsd.bin

2016-11-16 01:07:53.558000 : node1 : INFO : Resource 'ora.cvu' has been modified. : 14792791129816600/2580/7 :
2016-11-16 01:07:53.562000 : node2 : INFO : Clean of 'ora.cvu' on 'node2' succeeded : 14792791129816600/2580/8 :

To query all the activities that were written by a specific process by ID:

$ crsctl query calog -processid 6538

2016-11-16 01:07:53.558000 : node1 : INFO : Resource 'ora.cvu' has been modified. : 14792791129816600/2580/7 :
2016-11-16 01:07:53.562000 : node2 : INFO : Clean of 'ora.cvu' on 'node2' succeeded : 14792791129816600/2580/8 :

To query all the activities that were written by a specific node:

$ crsctl query calog -node node2
2016-11-16 01:07:53.562000 : node2 : INFO : Clean of 'ora.cvu' on 'node2' succeeded : 14792791129816600/2580/8 :