OCI Compute Instances Should Have Monitoring Enabled

Using Console

Below are step‑by‑step instructions to enable OCI Compute Monitoring from the OCI Console for both:

New instances (at creation time)
Existing instances (after they are already running)

I’ll also include the needed IAM policy.

1. Prerequisite: IAM Policy for Monitoring

Before enabling instance monitoring, make sure the Monitoring and Metrics services are allowed to write metrics into your compartment:

In the OCI Console, open the navigation menu and go to:
Identity & Security → Policies
Choose the compartment where you want to store metrics (often the root compartment).
Click Create Policy.
Give it a name (e.g., allow-monitoring-write-metrics) and description.

Under Policy Builder, choose Show manual editor and add something like:

allow service monitoring to use metrics in compartment <compartment-name>
allow service metrics to use metrics in compartment <compartment-name>

Click Create.

Replace <compartment-name> with the actual compartment where metrics will be stored.

2. Enable Monitoring for a New Compute Instance

In the OCI Console, open the navigation menu:
Core Infrastructure → Compute → Instances.
Click Create instance.
Fill out the basic details (name, compartment, image, shape, network, etc.).
Scroll down to the Placement and hardware or Additional configuration section (label may vary slightly by region/console version).
Find the Monitoring or Instance Monitoring subsection.
Check/enable the option such as:
- Enable monitoring, or
- Collect metrics for monitoring, or
- Enable compute instance monitoring.
If prompted, select:
- Metrics compartment – choose the compartment where metrics should be stored (the one covered by your policy).
Complete the rest of the instance configuration and click Create.

This ensures monitoring is enabled from the start.

3. Enable Monitoring on an Existing Compute Instance

In the OCI Console, open:
Core Infrastructure → Compute → Instances.
Select the compartment where the instance resides.
Click the instance name to open the Instance details page.
Look for a section or tab related to Monitoring or Oracle Cloud Agent:
- Sometimes this is under Resources → Oracle Cloud Agent,
- Or a Monitoring panel on the instance details page.
If you see that monitoring is Disabled or that the Monitoring plugin is disabled:
- Click Manage plugins / Edit Oracle Cloud Agent configuration / Edit (wording varies slightly).
- Ensure the plugin named Compute Instance Monitoring (or similar) is Enabled.
- Save/Apply the changes.

If there is a separate toggle for Enable compute instance monitoring directly on the instance:

Click Edit (top right of the instance details page).
Find the Monitoring option.
Check Enable monitoring (or equivalent).
Choose the Metrics compartment if prompted.
Click Save changes.

4. Verify That Monitoring Is Working

In the Console, go to:
Observability & Management → Metrics Explorer.
Select:
- Compartment: the one you configured for metrics.
- Namespace: something like oci_computeagent or similar.
Choose a metric such as:
- CpuUtilization
- MemoryUtilization (if supported by the plugin)
- DiskUtilization
Set the Resource group or Instance OCID filter to your instance.
Confirm that metrics are being displayed over time.

Following these steps will remediate the “OCI Compute Instances Should Have Monitoring Enabled” finding via the OCI Console.

Using CLI

You remediate this by updating each instance’s Oracle Cloud Agent configuration so that monitoring is enabled.Below is a minimal, step‑by‑step using OCI CLI.

1. Prerequisites

OCI CLI installed and configured (oci setup config)
OCID of the instance you want to fix
(you can list instances with:
oci compute instance list --compartment-id <compartment_ocid>)

2. Check current monitoring status for an instance

oci compute instance get \
  --instance-id <instance_ocid> \
  --query "data.\"agent-config\"" \
  --output table

Look for:

isMonitoringDisabled
pluginsConfig (especially Compute Instance Monitoring)

3. Enable instance monitoring (basic flag)

If monitoring is just disabled at the agent level:

oci compute instance update \
  --instance-id <instance_ocid> \
  --agent-config '{"isMonitoringDisabled": false}'

4. Explicitly enable the “Compute Instance Monitoring” plugin

To be explicit and ensure the plugin is ON:

oci compute instance update \
  --instance-id <instance_ocid> \
  --agent-config '{
    "isMonitoringDisabled": false,
    "pluginsConfig": [
      {
        "name": "Compute Instance Monitoring",
        "desiredState": "ENABLED"
      }
    ]
  }'

If you already have other plugins configured, include them too in pluginsConfig rather than overwriting.

5. Verify monitoring is enabled

oci compute instance get \
  --instance-id <instance_ocid> \
  --query "data.\"agent-config\"" \
  --output table

Confirm:

isMonitoringDisabled is false
Plugin Compute Instance Monitoring has desiredState = ENABLED

6. (Optional) Script for all instances in a compartment

COMPARTMENT_OCID="<compartment_ocid>"

for ID in $(oci compute instance list \
              --compartment-id "$COMPARTMENT_OCID" \
              --query 'data[]."id"' \
              --raw-output); do
  echo "Enabling monitoring on $ID"
  oci compute instance update \
    --instance-id "$ID" \
    --agent-config '{
      "isMonitoringDisabled": false,
      "pluginsConfig": [
        {
          "name": "Compute Instance Monitoring",
          "desiredState": "ENABLED"
        }
      ]
    }'
done

This will remediate the “OCI Compute Instances Should Have Monitoring Enabled” finding using OCI CLI.

Using Python

To remediate “OCI Compute Instances Should Have Monitoring Enabled” using Python, you need to ensure the Oracle Cloud Agent monitoring plugin is enabled on each instance by updating its agentConfig.Below is a step‑by‑step guide using the OCI Python SDK.

1. Prerequisites

Install the OCI Python SDK:

pip install oci

Have an OCI config file (e.g. ~/.oci/config) with:

[DEFAULT]
user=ocid1.user.oc1..aaaa...
fingerprint=xx:xx:xx:xx:xx
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..aaaa...
region=eu-frankfurt-1

Your IAM user/principal must have permissions like:

ALLOW GROUP <group-name> TO MANAGE instances IN TENANCY

2. Enable Monitoring on a Single Instance

import oci

# Load default config
config = oci.config.from_file("~/.oci/config", "DEFAULT")

compute_client = oci.core.ComputeClient(config)

# OCID of the instance you want to fix
INSTANCE_OCID = "ocid1.instance.oc1.eu-frankfurt-1......"

# Create agentConfig payload: set is_monitoring_disabled = False
agent_config = oci.core.models.UpdateInstanceAgentConfigDetails(
    is_monitoring_disabled=False
)

update_details = oci.core.models.UpdateInstanceDetails(
    agent_config=agent_config
)

response = compute_client.update_instance(
    instance_id=INSTANCE_OCID,
    update_instance_details=update_details
)

print("Update request submitted. New lifecycle state:", response.data.lifecycle_state)

This explicitly turns monitoring ON for that instance.

3. Remediate All Instances in a Compartment

This example finds all instances in a compartment and enables monitoring where it’s disabled.

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")
compute_client = oci.core.ComputeClient(config)

COMPARTMENT_OCID = "ocid1.compartment.oc1..aaaa..."  # set your compartment OCID

# List all instances in the compartment
instances = oci.pagination.list_call_get_all_results(
    compute_client.list_instances,
    compartment_id=COMPARTMENT_OCID
).data

for inst in instances:
    # Skip terminated instances
    if inst.lifecycle_state in ["TERMINATED", "TERMINATING"]:
        continue

    # Get full instance details so we can inspect agentConfig
    inst_details = compute_client.get_instance(inst.id).data
    current_agent_config = inst_details.agent_config

    # If monitoring is already enabled or config is missing, decide how to handle
    is_monitoring_disabled = None
    if current_agent_config is not None:
        is_monitoring_disabled = current_agent_config.is_monitoring_disabled

    if is_monitoring_disabled is False:
        print(f"[SKIP] Monitoring already enabled for {inst.display_name} ({inst.id})")
        continue

    print(f"[FIX] Enabling monitoring for {inst.display_name} ({inst.id})")

    new_agent_config = oci.core.models.UpdateInstanceAgentConfigDetails(
        is_monitoring_disabled=False
    )

    update_details = oci.core.models.UpdateInstanceDetails(
        agent_config=new_agent_config
    )

    resp = compute_client.update_instance(
        instance_id=inst.id,
        update_instance_details=update_details
    )

    print(f"  -> Update requested. Lifecycle state: {resp.data.lifecycle_state}")

4. Notes / Validation

After running, verify in the OCI Console:
- Go to Compute → Instances → [your instance] → Oracle Cloud Agent and confirm monitoring plugins are enabled.
If the monitoring plugin was manually disabled inside the OS, you may also need to:
- Ensure oracle-cloud-agent service is installed and running on the instance OS.

If you tell me your tenancy/compartment layout (e.g., need to run this across tenancy or by tag), I can adjust the script accordingly.

Using Terraform

resource "oci_core_instance" "THIS_INSTANCE" {
  # Replace with your compartment and instance details
  compartment_id = var.COMPartment_OCID   # set to your compartment OCID
  availability_domain = var.AVAILABILITY_DOMAIN
  shape              = var.INSTANCE_SHAPE
  display_name       = "MONITORED_INSTANCE"

  create_vnic_details {
    subnet_id = var.SUBNET_OCID
  }

  source_details {
    source_type = "image"
    source_id   = var.IMAGE_OCID
  }

  # Enable instance monitoring (Instance Monitoring plugin)
  agent_config {
    is_monitoring_disabled = false
  }
}

This change is an in-place update of the instance’s agent configuration and does not force replacement of the instance.Verification: terraform plan should show agent_config.is_monitoring_disabled changing from true (or null) to false for the oci_core_instance.THIS_INSTANCE resource, with no -/+ replacement indicator.

OCI Misconfigurations

OCI Compute Instances Should Have Monitoring Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisite: IAM Policy for Monitoring

2. Enable Monitoring for a New Compute Instance

3. Enable Monitoring on an Existing Compute Instance

4. Verify That Monitoring Is Working

1. Prerequisites

2. Check current monitoring status for an instance

3. Enable instance monitoring (basic flag)

4. Explicitly enable the “Compute Instance Monitoring” plugin

5. Verify monitoring is enabled

6. (Optional) Script for all instances in a compartment

1. Prerequisites

2. Enable Monitoring on a Single Instance

3. Remediate All Instances in a Compartment

4. Notes / Validation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Prerequisite: IAM Policy for Monitoring

​2. Enable Monitoring for a New Compute Instance

​3. Enable Monitoring on an Existing Compute Instance

​4. Verify That Monitoring Is Working

​1. Prerequisites

​2. Check current monitoring status for an instance

​3. Enable instance monitoring (basic flag)

​4. Explicitly enable the “Compute Instance Monitoring” plugin

​5. Verify monitoring is enabled

​6. (Optional) Script for all instances in a compartment

​1. Prerequisites

​2. Enable Monitoring on a Single Instance

​3. Remediate All Instances in a Compartment

​4. Notes / Validation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisite: IAM Policy for Monitoring

2. Enable Monitoring for a New Compute Instance

3. Enable Monitoring on an Existing Compute Instance

4. Verify That Monitoring Is Working

1. Prerequisites

2. Check current monitoring status for an instance

3. Enable instance monitoring (basic flag)

4. Explicitly enable the “Compute Instance Monitoring” plugin

5. Verify monitoring is enabled

6. (Optional) Script for all instances in a compartment

1. Prerequisites

2. Enable Monitoring on a Single Instance

3. Remediate All Instances in a Compartment

4. Notes / Validation