# Send Oracle logs to Graylog

**URL:** <https://community.graylog.org/t/send-oracle-logs-to-graylog/1388>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar, nxlog, filebeat-linux, filebeat-windows, nodatanx, multi-linenx, nosendlogfblx\
**Created:** [June 8, 2017, 1:35pm UTC](https://community.graylog.org/t/send-oracle-logs-to-graylog/1388 "2017-06-08T13:35:01Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![mgsteiner](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mgsteiner/32/1517_2.png) [@mgsteiner](https://community.graylog.org/u/mgsteiner)\
**Post date:** [June 8, 2017, 1:35pm UTC](https://community.graylog.org/t/send-oracle-logs-to-graylog/1388/1 "2017-06-08T13:35:01Z")

</div>

Hello there,

I’m trying to send Oracle logs (log.xml) to graylog via collector-sidecar without success.  
Does anybody has an idea how to configure that?

Thanks a log  
Max

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 8, 2017, 2:17pm UTC](https://community.graylog.org/t/send-oracle-logs-to-graylog/1388/2 "2017-06-08T14:17:37Z")

</div>

Hej Max,

some more information would be nice. What OS is your Oracle running on? What documentation/how-to did you follow? What are the problems you are facing?

---

<div class="post-metadata">

**Author:** ![mgsteiner](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mgsteiner/32/1517_2.png) [@mgsteiner](https://community.graylog.org/u/mgsteiner)\
**Post date:** [June 9, 2017, 8:48am UTC](https://community.graylog.org/t/send-oracle-logs-to-graylog/1388/3 "2017-06-09T08:48:01Z")

</div>

Hi Jan,

Graylog 2.2 OS :SLES12  
Oracle 11 OS: SLES12

The collector (Filebeat) is running well and if I go to Graylog console --\>Collectors and click on the server where the collector is running, I can see the Oracle Log file (log.xml), but i’m not getting any messages on the search view.

The collector was installed according to the installation guidelines from Graylog Documentation and is also implemented to get logs from Apache2 (which is working very well), but not when the logs to transfer are in an xml file (oracle case)

So, my questions are:

- how can I read the oracle log.xml file in graylog, or
- how can I transfer the logs entries from this log.xml file to Graylog

How-To documentation about transfer oracle logs to Graylog I did not found  
I have setup Graylog to get all Syslogs (Linux), Eventlogs (Windows) and logs from apache (linux) and everything works fine, except for oracle log.xml

Do you have an idea?

Thanks a lot in advance

BR  
Max

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 9, 2017, 10:09am UTC](https://community.graylog.org/t/send-oracle-logs-to-graylog/1388/4 "2017-06-09T10:09:15Z")

</div>

Hej Max,

I have written [this blog post](https://www.graylog.org/blog/73-back-to-basics-connecting-sidecar-and-processing-pipelines) about how to get a file into Graylog (multiline). Maybe this gives you an Idea.

Without knowing how you had configured the Sidecar, I did not have any Idea.

---

<div class="post-metadata">

**Author:** ![mgsteiner](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mgsteiner/32/1517_2.png) [@mgsteiner](https://community.graylog.org/u/mgsteiner)\
**Post date:** [June 9, 2017, 1:06pm UTC](https://community.graylog.org/t/send-oracle-logs-to-graylog/1388/5 "2017-06-09T13:06:00Z")

</div>

Thanks . Yeah your blog is interesting and actually I followed but still not working. So here are the configurations i have for Sidecar and filebeat:

– SIDECAR  
server\_url: http://:9000/api/  
update\_interval: 10  
tls\_skip\_verify: true  
send\_status: true  
list\_log\_files:  
- /oracle/v01/diag/rdbms/ksj/KSJ/alert  
node\_id:  
collector\_id: file:/etc/graylog/collector-sidecar/collector-id  
cache\_path: /var/cache/graylog/collector-sidecar  
log\_path: /var/log/graylog/collector-sidecar  
log\_rotation\_time: 86400  
log\_max\_age: 604800  
tags:  
- oracle  
backends:  
- name: nxlog  
enabled: false  
binary\_path: /usr/bin/nxlog  
configuration\_path: /etc/graylog/collector-sidecar/generated/nxlog.conf  
- name: filebeat  
enabled: true  
binary\_path: /usr/bin/filebeat  
configuration\_path: /etc/graylog/collector-sidecar/generated/filebeat.yml

– FILEBEAT  
filebeat:  
prospectors:

- document\_type: oracle  
encoding: plain  
fields:  
collector\_node\_id: kdcora002  
gl2\_source\_collector: acb88517-cf06-47ae-90c6-e88d6a554ff1  
logtype: alert  
ignore\_older: 0  
input\_type: log  
multiline:  
match: after  
negate: false  
pattern: ^\<msg|$  
paths:
  - /oracle/v01/diag/rdbms/ksj/KSJ/alertlog.xml  
scan\_frequency: 10s  
tail\_files: true  
output:  
logstash:  
hosts:
  - :5044  
path:  
data: /var/cache/graylog/collector-sidecar/filebeat/data  
logs: /var/log/graylog/collector-sidecar  
tags:

- oracle

So, the file is an xml log and contains multi-lines like this:  
  
Completed checkpoint up to RBA [0x595.2.10], SCN: 3394482

Now, I’m getting the logs in but the parsing for multiline does not really work. I got only one part of it:  
\<msg time=‘2017-06-09T14:02:47.134+02:00’ org\_id=‘oracle’ comp\_id=‘rdbms’

The rest is not being interpreted

Any hint?

---

<div class="post-metadata">

**Author:** ![mgsteiner](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mgsteiner/32/1517_2.png) [@mgsteiner](https://community.graylog.org/u/mgsteiner)\
**Post date:** [June 22, 2017, 8:03am UTC](https://community.graylog.org/t/send-oracle-logs-to-graylog/1388/6 "2017-06-22T08:03:37Z")

</div>

Hey Jan,

Did you have a chance to see my reply?

BR  
Max

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [June 23, 2017, 9:25am UTC](https://community.graylog.org/t/send-oracle-logs-to-graylog/1388/7 "2017-06-23T09:25:47Z")

</div>

This is not a personal support channel.

If you need individual support, consider buying Graylog Enterprise: [https://www.graylog.org/enterprise](https://www.graylog.org/enterprise)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 7, 2017, 9:26am UTC](https://community.graylog.org/t/send-oracle-logs-to-graylog/1388/8 "2017-07-07T09:26:05Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.