Communication Between Oracle Management Agent (OMA) and Oracle Enterprise Manager (OEM) in Oracle AI Database 26ai

The Oracle Management Agent communicates with Oracle Enterprise Manager 24ai using a push-based, secure, bidirectional protocol, primarily HTTPS, instead of the older SNMP-based polling used all the way back in Oracle 8i.

Feature	Oracle 8i (Intelligent Agent)	Current (Management Agent / EM 24ai)
Protocol	SNMP	HTTPS
Communication model	Pull-based (manager polls agents)	Push-based (agent sends data to OEM)
Security	Basic community strings	SSL/TLS encryption, certificate-based mutual authentication
Scalability	Limited, manual configuration	Dynamic, cloud-ready, auto-discovery, including Remote Agents
Monitoring type	Static, predefined metrics	Real-time, adaptive, plug-in based

Agent Registration and Secure Connection

1. The Management Agent is installed on a target host, database, middleware, or otherwise, and during setup registers with the OMS using its URL (for example, https://<OMS-host>:7802/em) and mutual TLS authentication, agent and OMS each verify the other's certificate before trusting the connection.
2. Two distinct ports carry this traffic, in two different directions. The agent listens on its own port, 3872 by default (officially registered with IANA for oem-agent), which the OMS uses when it needs to reach the agent directly, dispatching a job, for instance. The OMS's own upload port, 4903 in current releases, is what the agent connects to when pushing metrics, alerts, and job results upward. Both directions run over HTTPS, secured the same way, just carrying traffic opposite ways.
3. Oracle Wallet handles credential storage and encryption on both sides of that connection.

Data Collection and the Push Mechanism

1. The agent runs plug-ins, oracle.sysman.db for the database, oracle.sysman.emas for Fusion Middleware, among others, to actually collect metrics. Plug-ins can be Oracle-supplied or custom-developed.
2. Rather than waiting to be polled, the agent actively pushes data to the OMS at configured intervals: performance data (CPU, memory, SQL activity), alerts (threshold breaches, critical errors), and job statuses.
3. A periodic heartbeat confirms the agent is still available; if the OMS stops receiving one, it marks that agent unreachable.

Job Execution and Remote Operations

1. When an administrator schedules a job, a backup, a script, in Enterprise Manager, the command travels to the agent over HTTPS on the agent's own port. The agent executes it and reports status back.
2. Results stream back to the OMS in near real time; a SQL script run against a target database, for instance, gets relayed back through the agent as it completes.

High Availability
Multiple OMS instances can be configured for failover, and agents switch to a backup OMS automatically if the primary becomes unavailable.

The two-port, two-direction design isn't just an implementation detail, it has a real, practical consequence anywhere a firewall sits between an agent and its OMS. Both directions need to stay open for the relationship to work at all: the OMS needs to reach the agent's port, 3872 by default, to dispatch jobs and on-demand requests, and the agent needs to reach the OMS's upload port, 4903, to push its own metrics and results back. Opening only one direction leaves you with a monitoring setup that looks connected but is actually only half-working, an agent that can report data but never receive a job, or one that can be commanded but whose results never make it back.

Verifying either side is straightforward. Running emctl status agent on the target host confirms the agent's own listening port and its current connection state to the OMS; running emctl status oms -details on the management server confirms the OMS's upload port. Checking both, rather than assuming the default port numbers are actually what's configured, is worth doing before troubleshooting anything more complicated, since either one might have shifted to an alternate port if the default was already in use during installation.

• Stronger security: HTTPS plus TLS encryption and mutual certificate authentication, versus SNMP's weak, largely unauthenticated community-string model.
• Real, near-real-time data: the push model avoids the latency inherent in periodic polling.
• Dynamic and scalable: auto-discovery of targets, and cloud-friendly by design.
• Extensible: the plug-in architecture supports custom monitoring without touching the agent's own code.

Summary of the communication flow: the agent installs and registers with the OMS over HTTPS; it collects metrics through plug-ins and pushes them up periodically; it receives jobs from the OMS and executes them locally, reporting results back; and a continuous heartbeat keeps both sides aware of the connection's health.

Walking through one full cycle makes the two-port, two-direction design easier to hold onto than the abstract description alone. Say a tablespace on a monitored database starts filling up.

1. The agent, running its oracle.sysman.db plug-in, collects the tablespace usage metric on its normal cycle and connects out to the OMS's upload port to push that reading, no different from any other routine metric push.
2. The OMS evaluates the reading against the threshold configured for that target, sees it's crossed, and raises an incident.
3. An incident rule attached to that threshold has a corrective action configured: extend the tablespace automatically. The OMS dispatches that job by connecting to the agent's own listening port and sending the command.
4. The agent executes the job locally, on the database itself, and reports the result back through the same upload-port push mechanism it uses for ordinary metrics.

Two separate connections, in two separate directions, both required, both secured the same way, doing two genuinely different jobs. That's the whole architecture in miniature.

Oracle originally used the Simple Network Management Protocol (SNMP) to connect Intelligent Agents to the Event Manager. SNMP is a standard Internet protocol that lets management stations, the OEM data collectors, query managing nodes, the remote servers running an Intelligent Agent, for status and activity information. Managed elements were traditionally limited to network components like bridges and routers, but the definition was later extended to cover mission-critical applications such as databases.

An Intelligent Agent resided on the same node as the services it supported, and a single agent could support more than one service on that node, two databases installed on one machine, for instance, sharing a single agent. The agent's job was running jobs and monitoring events on OEM's behalf.

The next lesson looks at how a Management Agent is actually installed and configured today.