1. Audit
Audit is always on. Raise retention (default 365 days) only if regulation requires; archive to Object Storage for longer.
2. Service logs
Enable at compartment level for the types you'll need during incidents:
- VCN flow logs (subnets in production)
- Load balancer access and error logs
- Object Storage read/write logs for sensitive buckets
- API Gateway, Functions and WAF logs
Create log groups per compartment (for example lg-payments-prod).
3. Log archive
Connector Hub (Service Connector Hub) from Logging (Audit + service logs) → Object Storage bucket in the security compartment, with retention rules. Optionally → Streaming → SIEM.
4. Notifications topics and Events
oci ons topic create --compartment-id <cmp-security> --name ops-critical
oci ons subscription create --compartment-id <cmp-security> --topic-id <topic-ocid> --protocol EMAIL --subscription-endpoint ops@contoso.com
Event rules for: instance terminated, DB system state changes, backup failed, policy/group changes, VCN security list/NSG changes.
5. Baseline Monitoring alarms (MQL)
CpuUtilization[5m]{resourceDisplayName =~ "*prod*"}.mean() > 90
MemoryUtilization[5m].mean() > 90
Practical starter set:
| Namespace | Metric | Condition |
|---|---|---|
| oci_computeagent | CpuUtilization | mean > 90 for 15 min |
| oci_computeagent | MemoryUtilization | mean > 90 for 15 min |
| oci_lbaas | UnHealthyBackendServers | > 0 for 5 min |
| oci_autonomous_database | CpuUtilization | > 85 for 15 min |
| oci_database | StorageUtilization (DB systems) | > 85 |
| oci_objectstorage | ClientErrors (4xx spikes) | anomaly |
Alarm destinations: the ops-critical topic for paging, another for tickets.
6. Cloud Guard
- Enable Cloud Guard, choose a reporting region (findings from all regions land there).
- Target = root or landing zone compartment, Oracle-managed configuration and activity detector recipes (clone to customise), responder recipe in notify-only mode first.
- Route problems with risk level HIGH/CRITICAL via Events → Notifications.
7. Vulnerability Scanning and OS Management
Scanning recipes for hosts and container images; OS Management Hub for patch compliance.
DR note
Logging, alarms, topics and connectors are regional. Deploy the same set in the DR region through Terraform, otherwise you fail over into a region where nothing alerts.