Sources
Oracle
Check which Oracle releases SQL Flow supports and choose between the DirectLog and LogMiner capture modes.
SQL Flow captures changes from Oracle in two capture modes: DirectLog, which reads redo and archived log files through a log broker on the database host, and LogMiner, which mines the same redo through Oracle's DBMS_LOGMNR package over an ordinary database connection.
Supported versions
SQL Flow is tested on these Oracle releases:
| Oracle release | Version tested |
|---|---|
| Oracle Database 12c Release 2 | 12.2 |
| Oracle Database 19c | 19.3 |
| Oracle Database 21c | 21.3 |
| Oracle AI Database 26ai | 23.26 |
Other releases, including later release updates of these versions, are expected to work but aren't part of SQL Flow's testing. If you run an untested release, validate a pipeline in a test environment before you rely on it in production.
Both multitenant (CDB with PDBs) and non-CDB databases are supported. For a PDB, the connection form asks for two services:
| Field | What to enter | What uses it |
|---|---|---|
| Service name (PDB) | The service of the PDB that holds the source tables, for example ORCLPDB1 | Table discovery, the initial load, and row and LOB reads |
| Root service for capture | The CDB root service, for example ORCLCDB | Log mining and redo discovery, which Oracle only allows from CDB$ROOT |
Root service for capture is under Advanced capture settings in the connection form. Leave it empty for a non-CDB database; the source test refuses a PDB source without it. It uses the same login, password and encryption settings as the PDB connection, so the capture user must be a common user (for example C##SQLFLOW). Advanced capture settings also holds Agent memory limit (bytes): leave it blank to let the agent detect its available memory, or enter a lower limit for this source.
Connection encryption
Every Oracle connection has an Encryption setting:
| Setting | What the agent does |
|---|---|
| Require (default) | Connects to the listener's TLS (TCPS) port, validates the server certificate's chain against the agent host's trust store, and checks that its DN matches Server certificate DN, which the form requires. |
| Prefer | Connects over TLS, validated the same way, when Server certificate DN is set. With no TLS setting at all, it connects over plain, unencrypted TCP. |
Wallet path on agent is optional: a wallet supplies a client certificate, not the server's identity, so a wallet without a Server certificate DN is refused. Wallet files must exist on the agent host and be readable by the agent's service account.
Capture modes
| Mode | What it reads | Where it runs |
|---|---|---|
| DirectLog (default) | Online redo and archived log files | A log broker on the Oracle host serves the files to the agent |
| LogMiner | V$LOGMNR_CONTENTS from a DBMS_LOGMNR session | Inside the database, over the agent's ordinary connection |
Choosing a capture mode
- Are the redo logs and archived logs on a filesystem the database host can expose? The log broker can't read Oracle ASM storage (
+DATA/...).- No, they're in ASM: use LogMiner.
- Can you install a log broker on the Oracle host?
- No: use LogMiner.
- Does the database run more than one redo thread (Oracle RAC)?
- Yes: use LogMiner. DirectLog reads exactly one enabled redo thread.
- Are any of the tables in a TDE-encrypted tablespace, or do they have encrypted columns or encrypted SecureFile LOBs?
| DirectLog | LogMiner | |
|---|---|---|
| Typical lag | Milliseconds, from the online redo log | Seconds |
| Work on the database server | File reads by the broker, plus catalog queries | Mining sessions inside the database |
| Installs on the database host | Log broker | Nothing |
| ASM storage | Not supported | Supported |
| RAC (more than one redo thread) | Refused | Supported |
| Supplemental logging | Database minimal logging plus (ALL) COLUMNS on every table | Database minimal logging |
| Key privileges | Catalog views in the root and the PDB, FLASHBACK on tables | LOGMINING, dictionary access, FLASHBACK on tables |
| Database character set | AL32UTF8, UTF8, US7ASCII and four single-byte sets; see Requirements | Any |
Native BOOLEAN, JSON, VECTOR columns | Supported | Refused |
Extended-width VARCHAR2, NVARCHAR2, RAW columns (MAX_STRING_SIZE=EXTENDED) | Not tested | Refused |
LONG, LONG RAW columns | Supported, except an update that re-chains the row | Supported |
BFILE, REF, nested-table, ANYDATA, ANYTYPE, ANYDATASET and URI-type columns | Refused | Refused |
Encrypted data
| Kind | DirectLog | LogMiner |
|---|---|---|
| TDE tablespace or column encryption | Refused by name before the initial load, because DirectLog has no decryption step. | Supported while the database's TDE keystore is open. With the keystore closed, capture stops by name. |
| Encrypted SecureFile LOBs | Refused by name before the initial load. | Supported; the database decrypts them. |
| Connections | TLS with the certificate chain validated and the DN matched, under Encryption at Require (default). See Connection encryption. | The same as DirectLog |
See Encrypted data support for every engine.
