Skip to main content

How to View Oracle Alert Log XML Using ADRCI (KBA6740)



KBA# 6740


In some instances, Oracle alert logs may be provided in .xml format. Although legible, manually parsing XML formatted diagnostic data may be inefficient. Fortunately, Oracle provides a method for viewing alert log detail in 'plain text' without XML formatting using the Automatic Diagnostic Repository Command Interpreter (ADRCI) utility. This utility can be used to review an existing installation, but can also be used to review log files in an arbitrary location.


The alert log XML file must be transferred to a host with a functional Oracle installation (Oracle processes do not need to be running). Generally, the install version should not need to match the version of Oracle that generated the log file.

How to View an Alert Log

By altering the ADR base, the ADRCI utility can parse the XML log file output in an arbitrary location; however, the utility will still look for an expected directory structure under the ADR base:

<ADR BASE>/diag/rdbms/<some name>/<some name>/alert

<some name> is referenced, as the path ultimately does not matter (it is not required to be aligned with the customer database name, et cetera). In this example, using the /tmp directory for the ADR base, the directory structure can be created and .xml file relocated via:

$ mkdir -p /tmp/diag/rdbms/d/d/alert
$ cp log.xml /tmp/diag/rdbms/d/d/alert


If using Bash shell, the !$ shortcut can be used to repeat the last argument from previous command:

$ mkdir -p /tmp/diag/rdbms/d/d/alert
$ cp log.xml !$


Following the alert log relocation, ADRCI can be launched. Change the ADRCI base to /tmp using the set base command (if the command is successful, no return output is provided):

$ adrci

ADRCI: Release - Production on Wed Nov 18 12:16:20 2020

Copyright (c) 1982, 2019, Oracle and/or its affiliates.  All rights reserved.

ADR base = "/u01/app/oracle"
adrci> set base /tmp

The show alert command can now be used to review the output with XML formatting removed.  

adrci> show alert

The ADRCI utility also offers advance search and other functionality. The extent of options available for this use case can be reviewed using the help command:

adrci> help show alert

  Usage: SHOW ALERT [-p <predicate_string>]  [-term]
                    [ [-tail [num] [-f]] | [-file <alert_file_name>] ]
  Purpose: Show alert messages.

    [-p <predicate_string>]: The predicate string must be double-quoted.
    The fields in the predicate are the fields:
        ORIGINATING_TIMESTAMP         timestamp
        NORMALIZED_TIMESTAMP          timestamp
        ORGANIZATION_ID               text(65)
        COMPONENT_ID                  text(65)
        HOST_ID                       text(65)
        HOST_ADDRESS                  text(47)
        MESSAGE_TYPE                  number
        MESSAGE_LEVEL                 number
        MESSAGE_ID                    text(65)
        MESSAGE_GROUP                 text(65)
        CLIENT_ID                     text(65)
        MODULE_ID                     text(65)
        PROCESS_ID                    text(33)
        THREAD_ID                     text(65)
        USER_ID                       text(65)
        INSTANCE_ID                   text(65)
        DETAILED_LOCATION             text(161)
        UPSTREAM_COMP_ID              text(101)
        DOWNSTREAM_COMP_ID            text(101)
        EXECUTION_CONTEXT_ID          text(101)
        ERROR_INSTANCE_ID             number
        ERROR_INSTANCE_SEQUENCE       number
        MESSAGE_TEXT                  text(2049)
        MESSAGE_ARGUMENTS             text(513)
        SUPPLEMENTAL_ATTRIBUTES       text(513)
        SUPPLEMENTAL_DETAILS          text(4000)
        PROBLEM_KEY                   text(551)
        CON_UID                       number
        CONTAINER_ID                  number
        CONTAINER_NAME                text(31)

    [-tail [num] [-f]]: Output last part of the alert messages and 
    output latest messages as the alert log grows. If num is not specified, 
    the last 10 messages are displayed. If "-f" is specified, new data
    will append at the end as new alert messages are generated.

    [-term]: Direct results to terminal. If this option is not specified,
    the results will be open in an editor. 
    By default, it will open in vi on Linux, but "set editor" can be used
    to set other editors.

    [-file <alert_file_name>]: Allow users to specify an alert file which 
    may not be in ADR. <alert_file_name> must be specified with full path.
    Note that this option cannot be used with the -tail option

    show alert 
    show alert -p "message_text like '%incident%'"
    show alert -tail 20


Related Articles

The following articles may provide more information or related information to this article: