Oracle - multiple SIDs from the same host

[RSAAdmin]

When Oracle 10.2.0.4 syslogs to enVision, it does not send the SID of each instance with the message. Since we have multiple instances on the same host, we lose visibility to what happened in which instance.

I found mention in a blog post that there was a bug filed to add the SID to messages. I can't see the MetaLink entry so I'm not sure if there is an available fix.

The blog post suggests assigning different facility.priority settings to each instance as a way to differentiate them. Would this help in enVision?  My understanding was that enVision ignored the priority values when parsing the data, so I'm not sure there would be a way for it to tell the instances apart.

It's not an option for us at the moment, but does using ODBC audit collection instead of syslog allow for differentiating multiple database instances on the same host?

Anyone else having this much fun with Oracle and enVision? 

[RSAAdmin]

I have always used the Instance Name to identify the database, especially when they come from the same host.  DBID is a number, so not really all that human readable. 

Paul

[RSAAdmin]

Are you running Oracle 11.2?  The MetaLink article indicates that the database ID is included in syslog starting in 11.2.

The MetaLink also indicates that bug 6755639 is backportable to Oracle 10.2.0.4 and 11.1.0.7 (as of 12/22/2010), so it looks like that patch adds the DBID to each syslog message.

The new enVision patch (4.0SP4 patch 2) released yesterday shows a fix in the system to support the database ID in Oracle messages -- see ENV-36249.

I opened a case with Support and they told me

"We currently don’t support DBID in our reports. Our XMLs currently do not have this field to capture DBID in different messages. So there is possibility of unknowns messages or single instance for the database id."

I'm going to open an Enhancement Request on this.

[RSAAdmin]

Why would you need DBID?  You have the instance name, so if there are multiple databases on a single physical server, you can use the instance name as your identifier.  The instance name is supported in reports and alerts.

Paul

[RSAAdmin]

My InstanceName column in the Database table is empty for all entries.  I'm not sure why that is the case.

[RSAAdmin]

Can you post some of the messages from event viewer or lsdata?  it might be good to take a look at what you are seeing? 

[RSAAdmin]

Jumping back into an old thread.  We have an 11g (11.2.0.2) test instance available now, and this is what we are seeing as example messages in enVision.

Note that we only get DBID with an internal numeric value. The DBID number maps to the expected database name in the Oracle v$database table.

I'd much rather have the InstanceName, I'm not sure why we aren't getting that...perhaps we don't have enough AUDIT stuff turned on (mostly just DBA activity at this point).

2012/02/22 14:06:25.479 CST 10.10.10.10 Oracle Audit[25006]: LENGTH : '159' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[10] '3438270160'
2012/02/22 14:06:25.479 CST 10.10.10.10 Oracle Audit[25006]: LENGTH : '158' ACTION :[6] 'COMMIT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[10] '3438270160'
2012/02/22 14:06:29.245 CST 10.10.10.10 Oracle Audit[25006]: LENGTH : '158' ACTION :[6] 'COMMIT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[10] '3438270160'
2012/02/22 14:06:29.245 CST 10.10.10.10 Oracle Audit[25006]: LENGTH : '217' ACTION :[64] 'ALTER SYSTEM SET audit_syslog_level = "LOCAL1.INFO" SCOPE=SPFILE' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[10] '3438270160'

2012/02/22 14:33:04.767 CST 10.10.10.10 Oracle Audit[28806]: LENGTH : '159' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[10] '3438270160'
2012/02/22 14:33:04.767 CST 10.10.10.10 Oracle Audit[28806]: LENGTH : '158' ACTION :[6] 'COMMIT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[10] '3438270160'
2012/02/22 14:33:16.454 CST 10.10.10.10 Oracle Audit[28806]: LENGTH : '158' ACTION :[6] 'COMMIT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[10] '3438270160'
2012/02/22 14:33:16.454 CST 10.10.10.10 Oracle Audit[28806]: LENGTH : '443' ACTION :[289] 'SELECT NAME NAME_COL_PLUS_SHOW_PARAM,DECODE(TYPE,1,'boolean',2,'string',3,'integer',4,'file',5,'number',        6,'big integer', 'unknown') TYPE,DISPLAY_VALUE VALUE_COL_PLUS_SHOW_PARAM FROM V$PARAMETER WHERE UPPER(NAME) LIKE UPPER(:NMBIND_SHOW_OBJ) ORDER BY NAME_COL_PLUS_SHOW_PARAM,ROWNUM' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[10] '3438270160'

The other problem is that I don't see the DBID getting populated into any column of the enVision "Database" table.

  The Oracle 'alter' commands show the literal string "DBID" in the "Counter1String" column.

  The "Counter1" column contains a "0".

The DBID numeric value is found nowhere except the "Message" column.