USER_ID field in alert logs (also in V$DIAG_ALERT_EXT view) Does anyone know what triggers the USER_ID field in the log.xml to be populated?  The value also exists in the V$DIAG_ALERT_EXT view.

I've found by observing the logs that if a temp tablespace fills up, it will log the USER_ID of the problematic SQL statement causing the issue.  But other than that, it appears that value is always NULL.
Log.xml is the new log format of oracle database will be  substitute the actual alert.log in future (according to oracle roadmap).
Basically you can find in the log.xml all information available in the alert.log with some more details, like the USER_ID. However the database log file does not aim to alert you about specific user issue but only to problem might be considered database-wide.

This means that for almost all problem there is no USER_ID, like for

ORA-00257: archiver error. Connect internal only, until freed.


But for some issues caused and related to specific user action the USER_ID will be present. For example the alert log provide you only this line:

ORA-1555 snapshot too old: rollback segment number %s with name \"%s\" too small" 


(in 11g you have also part of sql statement)

The log.xml will show more data. Furthermore, log.xml is close part of ADRCI, the tool for incident diagnose and management, and to do its own work needs more data than the simpe ORA-xxxx.

So, everytime a USER_ID is applicable to the error you will find in the log.xml, otherwise no.