The usual picture
- VCN flow logs enabled on every subnet "for security".
- Custom logs from the agent shipping every application debug line.
- Logging Analytics ingesting the same data as OCI Logging.
- Nobody knows what's queried.
1. Find the big sources
In the console, Logging → Logs shows each log with its log group. Usage and cost appear in Cost Analysis (filter service Logging and Logging Analytics) grouped by compartment or tag.
Search query to estimate volume by log over a day:
search "<compartment-ocid>/<log-group-ocid>" | summarize count() by logid
For Logging Analytics, the Storage and Usage pages show active and archived storage by log source and entity.
2. Keep what you use
| Log | Keep? |
|---|---|
| Audit (always on, not billed as custom logs) | Yes; export for long-term retention if required |
| Load balancer access/error logs | Yes for public apps; sample or shorter retention for internal |
| VCN flow logs | For security-sensitive subnets and troubleshooting windows, not every subnet forever |
| Object Storage read/write logs | Only on buckets where you need data-access evidence |
| Functions and API Gateway logs | Yes, with app log levels at WARN in production |
| Custom agent logs | Specific files only, at sensible levels |
Turning off unused logs is the biggest single saving.
3. Reduce at the source
- Application log levels (INFO/WARN in prod), structured logs without huge payloads.
- Agent configuration (Unified Monitoring Agent): only the paths you need, exclude rotated/compressed files.
- Flow logs: enable on demand for an investigation, then disable.
4. Retention per log
Set log retention on each log to what's actually needed for operations (for example 30 days), and send anything required for longer to Object Storage:
oci logging log update --log-group-id $LG --log-id $LOG --retention-duration 30
5. Archive with Connector Hub
Connector Hub moves logs from Logging to Object Storage (or Streaming, Logging Analytics, Functions):
Source: Logging (log group / logs) → Target: Object Storage bucket "logs-archive"
Bucket lifecycle: move to Infrequent Access after 30 days, Archive after 90, delete after 7 years (if required)
That gives cheap long-term retention while keeping hot retention short.
6. Logging Analytics: active vs archival
- Data in active storage is searchable directly; archival storage is cheaper and must be recalled before searching.
- Set a data archiving policy (move to archive after N days of active storage).
- Don't ingest the same logs into Logging Analytics that you only need in OCI Logging. Pick per use case (Logging Analytics for deeper analytics, correlation and dashboards).
- Purge data no longer needed with purge policies.
7. Keep it under control
- Budget alert on Logging and Logging Analytics cost (per compartment).
- A monthly review of the top 10 logs by volume with owners.
- Logging settings in Terraform modules (retention, levels), so new environments start right.
Tip
Before disabling a log, check whether a Connector Hub, alarm or SIEM integration depends on it. Search existing connectors for the log OCID.
Checklist
- Largest logs and sources identified
- Unused service and custom logs disabled
- Log levels and agent paths trimmed
- Retention set per log
- Archive to Object Storage with lifecycle
- Logging Analytics archival and purge policies
- Budget and monthly review