OCI instance pool and cluster network audit events move to version 2 - updating Events rules, alarms and scripts before June 2027

#What's changing

Announced on 27 June 2026 in the OCI service change announcements:

• Compute instance management is deprecating audit events version 1 for instance pools and cluster networks.
• Customers must move to version 2 events.
• On 30 June 2027, version 1 events will no longer be emitted.
• New event names add a V2 suffix, for example AttachLoadBalancerV2, and some data attributes change.

Anything that matches on the old event names will quietly stop firing on that date. Nothing errors; your automation just stops.

#1. Find what depends on the old names

Events Service rules. List rules and look for instance pool or cluster network event types:

oci events rule list --compartment-id $C --all \
  --query "data[].{name:\"display-name\", id:id}" --output table

oci events rule get --rule-id <rule-ocid> --query "data.condition" --raw-output

Look in the condition JSON for com.oraclecloud.computemanagement. event types that relate to instance pools and cluster networks.

Audit queries. In Logging search, Logging Analytics or your SIEM, search for saved searches and detection rules that filter on these event names.

Scripts. Search code for event names used in parsing:

grep -rnE "AttachLoadBalancer|DetachLoadBalancer|InstancePool|ClusterNetwork" ./automation ./functions ./siem-rules

#2. See both versions side by side

Until 30 June 2027 both versions should be emitted. Perform a harmless operation on a test pool (for example, change its size by one and back) and look at the audit log:

oci audit event list --compartment-id $C \
  --start-time "$(date -u -d '-30 min' +%Y-%m-%dT%H:%M:%SZ)" \
  --end-time "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  --query "data[?contains(\"event-type\", 'computemanagement')].{type:\"event-type\", time:\"event-time\"}" \
  --output table

Compare the full JSON of a v1 and the matching v2 event. Note which attributes moved or were renamed, since the announcement says data attributes change too.

#3. Update consumers

• Events rules: add the V2 event types to the rule condition. Keep the V1 type in the list until you've confirmed V2 fires, then remove V1.
• Functions and scripts: update parsing for the new attribute names. Make the code accept both formats during the transition.
• SIEM and saved searches: update filters and any field extractions.
• Runbooks and dashboards: update screenshots and queries that people copy.

Example rule condition during the transition:

{
  "eventType": [
    "com.oraclecloud.computemanagement.attachloadbalancer",
    "com.oraclecloud.computemanagement.attachloadbalancerv2"
  ]
}

(Use the exact event type strings you saw in step 2; don't copy these blindly.)

#4. Test and remove V1

Trigger each operation your automation cares about on a test pool, confirm the V2 path works end to end (rule fires, notification arrives, function succeeds), then remove the V1 matching.

#Checklist

• Events rules, saved searches, SIEM rules and scripts using v1 names found
• v1 and v2 payloads compared for each event you use
• Consumers accept v2 (and both during the transition)
• End-to-end tests passed on a test pool
• v1 matching removed well before 30 June 2027

#Sources

• OCI Service Change Announcements - Compute