Home / OCI

OCICheat sheetBeginner

OCI Logging: enabling service logs and searching them during an incident

Which logs to enable before you need them, plus Logging Search queries for VCN flow logs, load balancer errors, Object Storage access and Audit events.

Deepak Bhardwaj2 min read

Applies toOCI Logging, Audit, VCN flow logs, Load Balancer, Object Storage

Logs available in OCI

Type Enabled by default? Examples
Audit Yes (retained 365 days) Every API call: who changed what
Service logs No, enable per resource VCN flow logs, LB access and error logs, Object Storage read/write, Functions, API Gateway
Custom logs No, needs the agent Application and OS log files collected by the Oracle Cloud Agent / Unified Monitoring Agent

Enable service logs before incidents. You can't look back further than the day you turned them on.

oci logging log-group create --compartment-id $C --display-name prod-logs
oci logging log create --log-group-id $LG --display-name lb-prod-access --log-type SERVICE \
  --configuration '{"source":{"sourceType":"OCISERVICE","service":"loadbalancer","resource":"<lb-ocid>","category":"access"},"compartmentId":"'$C'"}'

Search syntax

Console: Observability → Logging → Search. Queries look like this:

search "<compartment-ocid>/<log-group-ocid>/<log-ocid>" | where <condition> | sort by datetime desc

Useful queries

Rejected traffic to a database (VCN flow logs)

search "<compartment>/<log-group>/<flow-log>"
| where data.action = 'REJECT' and data.destinationPort = 1521
| sort by datetime desc

Load balancer 5xx errors

search "<compartment>/<log-group>/<lb-access-log>"
| where data.backendStatusCode >= 500
| summarize count() by data.backendAddr

Who deleted something (Audit)

search "<compartment-ocid>/_Audit"
| where data.request.action = 'DELETE'
| select datetime, data.identity.principalName, data.eventName, data.resourceName
| sort by datetime desc

Failed API calls by a user

search "<compartment-ocid>/_Audit"
| where data.identity.principalName = 'jane.doe@contoso.com' and data.response.status >= '400'

oci logging-search search-logs \
  --search-query "search \"$C/_Audit\" | where data.eventName = 'TerminateInstance'" \
  --time-start "$(date -u -d '-24 hours' +%FT%TZ)" --time-end "$(date -u +%FT%TZ)"

Keep logs longer, or send them elsewhere

  • Default retention for service and custom logs is 30 days, adjustable up to 180.
  • Use Connector Hub to archive logs to Object Storage, or stream them to a SIEM (Splunk, Sentinel, QRadar) through Streaming.

Tip

Field names differ by log type. Open one log entry in the console and expand its JSON before you write a filter.

Related fixes