> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI Compute Instances Should Have Monitoring Enabled ### More Info: Compute instances should have monitoring enabled. Without monitoring, performance degradation, security incidents, and resource exhaustion go undetected until service impact occurs. ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST SP 800-171 * NYDFS 23 NYCRR 500 * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Below are step‑by‑step instructions to enable OCI Compute Monitoring from the OCI Console for both: 1. **New instances (at creation time)** 2. **Existing instances (after they are already running)** I’ll also include the needed IAM policy. *** ## 1. Prerequisite: IAM Policy for Monitoring Before enabling instance monitoring, make sure the **Monitoring** and **Metrics** services are allowed to write metrics into your compartment: 1. In the OCI Console, open the navigation menu and go to:\ **Identity & Security → Policies** 2. Choose the compartment where you want to store metrics (often the root compartment). 3. Click **Create Policy**. 4. Give it a name (e.g., `allow-monitoring-write-metrics`) and description. 5. Under **Policy Builder**, choose **Show manual editor** and add something like: ```text theme={null} allow service monitoring to use metrics in compartment allow service metrics to use metrics in compartment ``` 6. Click **Create**. Replace `` with the actual compartment where metrics will be stored. *** ## 2. Enable Monitoring for a New Compute Instance 1. In the OCI Console, open the navigation menu:\ **Core Infrastructure → Compute → Instances**. 2. Click **Create instance**. 3. Fill out the basic details (name, compartment, image, shape, network, etc.). 4. Scroll down to the **Placement and hardware** or **Additional configuration** section (label may vary slightly by region/console version). 5. Find the **Monitoring** or **Instance Monitoring** subsection. 6. Check/enable the option such as: * **Enable monitoring**, or * **Collect metrics for monitoring**, or * **Enable compute instance monitoring**. 7. If prompted, select: * **Metrics compartment** – choose the compartment where metrics should be stored (the one covered by your policy). 8. Complete the rest of the instance configuration and click **Create**. This ensures monitoring is enabled from the start. *** ## 3. Enable Monitoring on an Existing Compute Instance 1. In the OCI Console, open:\ **Core Infrastructure → Compute → Instances**. 2. Select the compartment where the instance resides. 3. Click the instance name to open the **Instance details** page. 4. Look for a section or tab related to **Monitoring** or **Oracle Cloud Agent**: * Sometimes this is under **Resources → Oracle Cloud Agent**, * Or a **Monitoring** panel on the instance details page. 5. If you see that monitoring is **Disabled** or that the **Monitoring plugin** is disabled: * Click **Manage plugins** / **Edit Oracle Cloud Agent configuration** / **Edit** (wording varies slightly). * Ensure the plugin named **Compute Instance Monitoring** (or similar) is **Enabled**. * Save/Apply the changes. If there is a separate toggle for **Enable compute instance monitoring** directly on the instance: 6. Click **Edit** (top right of the instance details page). 7. Find the **Monitoring** option. 8. Check **Enable monitoring** (or equivalent). 9. Choose the **Metrics compartment** if prompted. 10. Click **Save changes**. *** ## 4. Verify That Monitoring Is Working 1. In the Console, go to:\ **Observability & Management → Metrics Explorer**. 2. Select: * **Compartment**: the one you configured for metrics. * **Namespace**: something like `oci_computeagent` or similar. 3. Choose a metric such as: * `CpuUtilization` * `MemoryUtilization` (if supported by the plugin) * `DiskUtilization` 4. Set the **Resource group** or **Instance OCID** filter to your instance. 5. Confirm that metrics are being displayed over time. *** Following these steps will remediate the “OCI Compute Instances Should Have Monitoring Enabled” finding via the OCI Console. You remediate this by updating each instance’s Oracle Cloud Agent configuration so that monitoring is enabled. Below is a minimal, step‑by‑step using OCI CLI. *** ### 1. Prerequisites * OCI CLI installed and configured (`oci setup config`) * OCID of the instance you want to fix\ (you can list instances with:\ `oci compute instance list --compartment-id `) *** ### 2. Check current monitoring status for an instance ```bash theme={null} oci compute instance get \ --instance-id \ --query "data.\"agent-config\"" \ --output table ``` Look for: * `isMonitoringDisabled` * `pluginsConfig` (especially `Compute Instance Monitoring`) *** ### 3. Enable instance monitoring (basic flag) If monitoring is just disabled at the agent level: ```bash theme={null} oci compute instance update \ --instance-id \ --agent-config '{"isMonitoringDisabled": false}' ``` *** ### 4. Explicitly enable the “Compute Instance Monitoring” plugin To be explicit and ensure the plugin is ON: ```bash theme={null} oci compute instance update \ --instance-id \ --agent-config '{ "isMonitoringDisabled": false, "pluginsConfig": [ { "name": "Compute Instance Monitoring", "desiredState": "ENABLED" } ] }' ``` If you already have other plugins configured, include them too in `pluginsConfig` rather than overwriting. *** ### 5. Verify monitoring is enabled ```bash theme={null} oci compute instance get \ --instance-id \ --query "data.\"agent-config\"" \ --output table ``` Confirm: * `isMonitoringDisabled` is `false` * Plugin `Compute Instance Monitoring` has `desiredState` = `ENABLED` *** ### 6. (Optional) Script for all instances in a compartment ```bash theme={null} COMPARTMENT_OCID="" for ID in $(oci compute instance list \ --compartment-id "$COMPARTMENT_OCID" \ --query 'data[]."id"' \ --raw-output); do echo "Enabling monitoring on $ID" oci compute instance update \ --instance-id "$ID" \ --agent-config '{ "isMonitoringDisabled": false, "pluginsConfig": [ { "name": "Compute Instance Monitoring", "desiredState": "ENABLED" } ] }' done ``` This will remediate the “OCI Compute Instances Should Have Monitoring Enabled” finding using OCI CLI. To remediate **“OCI Compute Instances Should Have Monitoring Enabled”** using Python, you need to ensure the **Oracle Cloud Agent monitoring plugin is enabled** on each instance by updating its `agentConfig`. Below is a step‑by‑step guide using the OCI Python SDK. *** ## 1. Prerequisites 1. Install the OCI Python SDK: ```bash theme={null} pip install oci ``` 2. Have an OCI config file (e.g. `~/.oci/config`) with: ```ini theme={null} [DEFAULT] user=ocid1.user.oc1..aaaa... fingerprint=xx:xx:xx:xx:xx key_file=/path/to/oci_api_key.pem tenancy=ocid1.tenancy.oc1..aaaa... region=eu-frankfurt-1 ``` 3. Your IAM user/principal must have permissions like: ```text theme={null} ALLOW GROUP TO MANAGE instances IN TENANCY ``` *** ## 2. Enable Monitoring on a Single Instance ```python theme={null} import oci # Load default config config = oci.config.from_file("~/.oci/config", "DEFAULT") compute_client = oci.core.ComputeClient(config) # OCID of the instance you want to fix INSTANCE_OCID = "ocid1.instance.oc1.eu-frankfurt-1......" # Create agentConfig payload: set is_monitoring_disabled = False agent_config = oci.core.models.UpdateInstanceAgentConfigDetails( is_monitoring_disabled=False ) update_details = oci.core.models.UpdateInstanceDetails( agent_config=agent_config ) response = compute_client.update_instance( instance_id=INSTANCE_OCID, update_instance_details=update_details ) print("Update request submitted. New lifecycle state:", response.data.lifecycle_state) ``` This explicitly turns **monitoring ON** for that instance. *** ## 3. Remediate All Instances in a Compartment This example finds all instances in a compartment and enables monitoring where it’s disabled. ```python theme={null} import oci config = oci.config.from_file("~/.oci/config", "DEFAULT") compute_client = oci.core.ComputeClient(config) COMPARTMENT_OCID = "ocid1.compartment.oc1..aaaa..." # set your compartment OCID # List all instances in the compartment instances = oci.pagination.list_call_get_all_results( compute_client.list_instances, compartment_id=COMPARTMENT_OCID ).data for inst in instances: # Skip terminated instances if inst.lifecycle_state in ["TERMINATED", "TERMINATING"]: continue # Get full instance details so we can inspect agentConfig inst_details = compute_client.get_instance(inst.id).data current_agent_config = inst_details.agent_config # If monitoring is already enabled or config is missing, decide how to handle is_monitoring_disabled = None if current_agent_config is not None: is_monitoring_disabled = current_agent_config.is_monitoring_disabled if is_monitoring_disabled is False: print(f"[SKIP] Monitoring already enabled for {inst.display_name} ({inst.id})") continue print(f"[FIX] Enabling monitoring for {inst.display_name} ({inst.id})") new_agent_config = oci.core.models.UpdateInstanceAgentConfigDetails( is_monitoring_disabled=False ) update_details = oci.core.models.UpdateInstanceDetails( agent_config=new_agent_config ) resp = compute_client.update_instance( instance_id=inst.id, update_instance_details=update_details ) print(f" -> Update requested. Lifecycle state: {resp.data.lifecycle_state}") ``` *** ## 4. Notes / Validation * After running, verify in the OCI Console: * Go to **Compute → Instances → \[your instance] → Oracle Cloud Agent** and confirm monitoring plugins are enabled. * If the monitoring plugin was manually disabled inside the OS, you may also need to: * Ensure `oracle-cloud-agent` service is installed and running on the instance OS. If you tell me your tenancy/compartment layout (e.g., need to run this across tenancy or by tag), I can adjust the script accordingly. ```hcl theme={null} resource "oci_core_instance" "THIS_INSTANCE" { # Replace with your compartment and instance details compartment_id = var.COMPartment_OCID # set to your compartment OCID availability_domain = var.AVAILABILITY_DOMAIN shape = var.INSTANCE_SHAPE display_name = "MONITORED_INSTANCE" create_vnic_details { subnet_id = var.SUBNET_OCID } source_details { source_type = "image" source_id = var.IMAGE_OCID } # Enable instance monitoring (Instance Monitoring plugin) agent_config { is_monitoring_disabled = false } } ``` This change is an in-place update of the instance’s agent configuration and does not force replacement of the instance. Verification: `terraform plan` should show `agent_config.is_monitoring_disabled` changing from `true` (or `null`) to `false` for the `oci_core_instance.THIS_INSTANCE` resource, with no `-/+` replacement indicator.