Oracle Autonomous Health Framework (AHF) and Trace File Analyzer (TFA) help you summarize events, search logs, build timelines, collect diagnostics, and generate best-practice compliance reports—often without manually hunting through multiple log locations.
This guide groups practical commands by real-world tasks you’ll hit on Oracle database hosts and clusters.
1. Quick sanity checks: Is AHF/TFA up, and what version is it?
AHF status and version
ahfctl version
ahfctl statusahf
OCLUMON (Cluster Health Monitor) basics
oclumon -help
oclumon version
Tip: For cluster issues, OCLUMON provides health context while TFA provides log evidence.
2. First look triage: What’s going on right now?
Summary view (run as root when possible)
tfactl summary
Event stream and recent changes
tfactl events
tfactl changes
3. Analyze logs like a pro: tfactl analyze
Summarize alert and system messages
/opt/oracle.ahf/tfa/bin/tfactl analyze -since 5h
System messages for the last day
/opt/oracle.ahf/tfa/bin/tfactl analyze -comp os -since 1d
Search ORA- in the last 2 days
/opt/oracle.ahf/tfa/bin/tfactl analyze -search "ORA-" -since 2d
Case-sensitive search (example: "Starting")
/opt/oracle.ahf/tfa/bin/tfactl analyze -search "/Starting/c" -since 2d
OSWatcher top summary (last 6 hours)
/opt/oracle.ahf/tfa/bin/tfactl analyze -comp osw -since 6h
OSWatcher slabinfo for a specific time window
/opt/oracle.ahf/tfa/bin/tfactl analyze -comp oswslabinfo \
-from "Feb/26/2014 05:00:01" \
-to "Feb/26/2014 06:00:01"
Analyze generic messages (last 1 hour)
/opt/oracle.ahf/tfa/bin/tfactl analyze -since 1h -type generic
4. Timelines: correlate multiple alert logs in one view
/opt/oracle.ahf/tfa/bin/tfactl analyze timeline \
alert.log alert_DBINST.log alert_+ASM1.log
Use this to align ASM, DB, and CRS activity and quickly determine ordering and correlation.
5. Fast error summaries
Alert log summary and quick grep
tfactl alertsummary
tfactl grep -i "error" alert
Targeted ORA search example (ORA-04031)
tfactl analyze -search "ORA-04031" -last 1d
6. Performance snapshots: oratop and OSWatcher
oratop (batch mode)
/opt/oracle.ahf/tfa/bin/tfactl analyze -comp oratop -database dbname -bn1
oratop (interactive mode, local instance)
/opt/oracle.ahf/tfa/bin/tfactl analyze -comp oratop -database dbname -d
Shortcuts via tfactl run
tfactl run oratop -database PROD
tfactl run oswbb
7. Diagnostic collections: tfactl diagcollect
Basic collections
/opt/oracle.ahf/tfa/bin/tfactl diagcollect
/opt/oracle.ahf/tfa/bin/tfactl diagcollect -last 8h
Collect specific databases and name the zip
/opt/oracle.ahf/tfa/bin/tfactl diagcollect \
-database hrdb,fdb -last 1d \
-z foo
CRS and OS logs for specific nodes
/opt/oracle.ahf/tfa/bin/tfactl diagcollect \
-crs -os -node node1,node2 -last 6h
ASM logs for a specific time range
/opt/oracle.ahf/tfa/bin/tfactl diagcollect \
-asm -node node1 \
-from "May/04/2025" \
-to "May/04/2025 21:00:00"
Collect by date or around a timestamp
/opt/oracle.ahf/tfa/bin/tfactl diagcollect -for "May/04/2025"
/opt/oracle.ahf/tfa/bin/tfactl diagcollect -for "May/04/2025 21:00:00"
Include additional directories
/opt/oracle.ahf/tfa/bin/tfactl diagcollect \
-crs -collectdir /tmp_dir1,/tmp_dir2
8. SRDC collections: when you know the symptom
ORA-00600 SRDC example
tfactl diagcollect -srdc ORA-00600
If the database is not discovered (for example: “Database PROD was not found”), run a full rediscover as the TFA Administrator (often root) and retry.
tfactl rediscover -mode full
tfactl diagcollect -srdc ORA-00600
dbperf SRDC with AHF Insights
tfactl diagcollect -srdc dbperf -database PROD -insights
Data Guard SRDC
tfactl diagcollect -srdc dbdataguard
9. AHF analysis reports: Insights and Impact
Insights report for the last 6 hours
ahf analysis create --type insights --last 6h
Impact analysis (cluster and database scopes)
ahf analysis create --type impact \
--scope cluster --name cluster1
ahf analysis create --type impact \
--scope database --cluster cluster1 --name database1
10. Compliance and best-practice checks
Compliance baseline and security profile
ahfctl compliance
ahfctl compliance -profile security
ahfctl compliance -includeprofile security
11. Log maintenance
Dry-run purge older than 30 days
tfactl managelogs -purge -older 30d -dryrun
12. Practical troubleshooting flows
tfactl summary
tfactl analyze -since 6h
tfactl analyze -comp osw -since 6h
tfactl run oratop -database PROD
ahf analysis create --type insights --last 6h
tfactl diagcollect -srdc dbperf -database PROD -insights
Scenario B: ORA errors started appearing
tfactl alertsummary
tfactl analyze -search "ORA-" -since 2d
tfactl grep -i "error" alert
tfactl diagcollect -last 8h
Scenario C: Cluster instability or node issues
oclumon version
tfactl summary
tfactl analyze -comp os -since 1d
tfactl diagcollect -crs -os -node node1,node2 -last 6h
ahf analysis create --type impact --scope cluster --name cluster1
Most of the value from AHF/TFA comes from a small core set of commands: summary/events/changes for quick triage, analyze with -since and -search for log insights, diagcollect with -last or -srdc for targeted diagnostics, and compliance to validate build readiness and security posture.
