https://community.splunk.com/t5/Deployment-Architecture/How-to-monitoring-a-log-in-a-cluster-failover-environemnt/m-p/25794#M623 <P>Hi all,<BR /> I'm studying how to apply splunk to my architecture. I've a simple question about log monitoring.<BR /> I've a cluster failover with different oracle instances. <BR /> Now for example INSTACE1 is running on nodeA and INSTANCE2 is running on nodeB. <BR /> So I have on nodeA the alert log in path<BR /> /opt/oracle/instance1/diag/rdbms/instance1/INSTANCE1/trace/alert_INSTANCE1.log</P> <P>Ok, with a forwarder I can setup the reading of log in a very simple way. But how I can define to monitor this log on both nodeA (when instance is running on nodeA) and on nodeB (when instance switches on nodeB)?<BR /> Hence the same question may be applied to process monitoring, process ora_pmon_INSTANCE1 should run at least on one node...</P> <P>Any interesting idea?</P> <P>Thanks<BR /> Ste</P> Mon, 28 Sep 2020 11:40:24 GMT scislaghi 2020-09-28T11:40:24Z https://community.splunk.com/t5/Deployment-Architecture/How-to-monitoring-a-log-in-a-cluster-failover-environemnt/m-p/25794#M623 <P>Hi all,<BR /> I'm studying how to apply splunk to my architecture. I've a simple question about log monitoring.<BR /> I've a cluster failover with different oracle instances. <BR /> Now for example INSTACE1 is running on nodeA and INSTANCE2 is running on nodeB. <BR /> So I have on nodeA the alert log in path<BR /> /opt/oracle/instance1/diag/rdbms/instance1/INSTANCE1/trace/alert_INSTANCE1.log</P> <P>Ok, with a forwarder I can setup the reading of log in a very simple way. But how I can define to monitor this log on both nodeA (when instance is running on nodeA) and on nodeB (when instance switches on nodeB)?<BR /> Hence the same question may be applied to process monitoring, process ora_pmon_INSTANCE1 should run at least on one node...</P> <P>Any interesting idea?</P> <P>Thanks<BR /> Ste</P> Mon, 28 Sep 2020 11:40:24 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-monitoring-a-log-in-a-cluster-failover-environemnt/m-p/25794#M623 scislaghi 2020-09-28T11:40:24Z https://community.splunk.com/t5/Deployment-Architecture/How-to-monitoring-a-log-in-a-cluster-failover-environemnt/m-p/25795#M624 <P>Could you not monitor both files all the time? </P> <P>If the paths are the same, you could have the same config on both/all forwarders (I'm assuming that you have more than one host).</P> <PRE><CODE>[monitor:///opt/oracle/instance*/diag/rdbms/instance*/INSTANCE*/trace/alert_INSTANCE*.log] </CODE></PRE> <P>Or am I missing something?</P> <P>/Kristian</P> Thu, 12 Apr 2012 18:31:36 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-monitoring-a-log-in-a-cluster-failover-environemnt/m-p/25795#M624 kristian_kolb 2012-04-12T18:31:36Z https://community.splunk.com/t5/Deployment-Architecture/How-to-monitoring-a-log-in-a-cluster-failover-environemnt/m-p/25796#M625 <P>can you clarify what happens to the file on failover? If you fail instance 1 over from nodeA to nodeB, does the new instance 1 that is running on nodeB start writing to a new file? Or does the old file get moved over from nodeA to nodeB, and then the new instance starts appending to the moved copy of the file?</P> Thu, 12 Apr 2012 23:06:06 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-monitoring-a-log-in-a-cluster-failover-environemnt/m-p/25796#M625 gkanapathy 2012-04-12T23:06:06Z https://community.splunk.com/t5/Deployment-Architecture/How-to-monitoring-a-log-in-a-cluster-failover-environemnt/m-p/25797#M626 <P>Log file is on ashared filesystem and in case of failover the filesystem is dismounted from nodeA and remounted on nodeB. You'll write on the same file in the same path on a different node.</P> Fri, 13 Apr 2012 05:21:00 GMT https://community.splunk.com/t5/Deployment-Architecture/How-to-monitoring-a-log-in-a-cluster-failover-environemnt/m-p/25797#M626 scislaghi 2012-04-13T05:21:00Z