OCI Logging Should Have Active Log Groups

Using Console

Below are the steps to ensure OCI Logging has active log groups for Monitoring, using the OCI Console.

1. Verify Existing Log Groups

Sign in to the OCI Console.
In the left hamburger menu, go to
Observability & Management → Logging → Log groups.
Select the correct compartment (top-left of the page).
Check if any Log groups exist and are in Active state.
- If none exist, proceed to create one.

2. Create a Log Group (if missing)

On the Log groups page, click Create log group.
Fill in:
- Name: e.g. monitoring-log-group.
- Description: optional.
- Compartment: choose the compartment where Monitoring resources reside.
Click Create.
Ensure the new log group status is Active.

3. Enable Logging for the Monitoring Service

In the menu, go to
Observability & Management → Logging → Logs.
Make sure you’re in the same compartment and region as your Monitoring resources.
Click Create custom log (or Enable service log, depending on the UI version):
- Log group: select the active log group you created (e.g. monitoring-log-group).
- Log name: e.g. monitoring-service-log.
- Log source / Resource: choose Service logs and then select the Monitoring service (and specific resource type if required).
Configure any additional options (retention, filters) as needed.
Click Create or Enable to activate the log.

4. Confirm Logs Are Active

Still under Logging → Logs, verify:
- The log is listed.
- Status is Active.
Optionally, generate some Monitoring activity (e.g., create/modify an alarm) and:
- Open the log.
- Use Search to confirm events are being recorded.

This ensures OCI Logging has at least one active log group and active logs tied to the Monitoring service.

Using CLI

To fix “OCI Logging Should Have Active Log Groups” for Monitoring logs using the OCI CLI, you need to:

Ensure there is at least one active log group in the target compartment.
Enable service logs for Monitoring into that log group.

Below are step‑by‑step CLI instructions.

0. Prerequisites

OCI CLI installed and configured (oci setup config)
Values ready:
- TENANCY_OCID
- COMPARTMENT_OCID (where you want the log group and logs)
- REGION (e.g., us-ashburn-1)

You can set defaults:

export OCI_CLI_PROFILE=DEFAULT
export OCI_CLI_REGION=us-ashburn-1

1. Check if any active log groups already exist

oci logging log-group list \
  --compartment-id <COMPARTMENT_OCID> \
  --all

If you see a log group with "lifecycle-state": "ACTIVE" you can reuse it.
Note its id (log group OCID). If none exist, create one.

2. Create a log group (if none exists)

oci logging log-group create \
  --compartment-id <COMPARTMENT_OCID> \
  --display-name "monitoring-log-group" \
  --description "Log group for OCI Monitoring service logs"

Capture the log group OCID from the output:

LOG_GROUP_ID=<LOG_GROUP_OCID_FROM_OUTPUT>

If you already had one, just set:

LOG_GROUP_ID=<EXISTING_LOG_GROUP_OCID>

3. Enable Monitoring service logs in that log group

OCI Monitoring writes service logs under the Logging service. You enable a service log with oci logging log create using --source-service monitoring.

3.1. Identify the log you want (region/compartment specific)

For basic Monitoring service activity logs, a common pattern is:

source-service: monitoring
source-resource: usually the compartment or tenancy (for tenancy‑level logs)
category and service-logs differ by region/service version; a simple way is to list available service categories:

oci logging log list \
  --log-group-id $LOG_GROUP_ID \
  --all

If you don’t have any yet (likely), you create one explicitly:

3.2. Create a Monitoring service log

Example: enable Monitoring service log at tenancy scope (replace with compartment if needed):

oci logging log create \
  --log-group-id $LOG_GROUP_ID \
  --display-name "oci-monitoring-service-log" \
  --log-type SERVICE \
  --is-enabled true \
  --configuration '{
    "source": {
      "category": "api",
      "resource": "<TENANCY_OCID>",
      "service": "monitoring",
      "serviceType": "oci"
    }
  }'

Notes:

category may vary by region/tenant (api, workrequests, etc.). If api fails, check documentation or UI for available categories for Monitoring in your region.
If you want logs scoped to a compartment instead of tenancy:

"resource": "<COMPARTMENT_OCID>"

4. Verify the log is active

oci logging log list \
  --log-group-id $LOG_GROUP_ID \
  --all

Check that:

lifecycle-state is ACTIVE
is-enabled is true

5. (Optional) Enable additional Monitoring categories

If you need more than one category (e.g., api, workrequests), repeat step 3.2 with another display-name and category.

Once you have at least one ACTIVE log group and at least one ENABLED Monitoring service log in it, the “OCI Logging Should Have Active Log Groups” finding for Monitoring should be remediated.

Using Python

Below is a minimal, step‑by‑step approach to ensure OCI Logging has at least one active log group, and to programmatically create and enable a log for Monitoring using Python.

1. Prerequisites

Install OCI Python SDK:
pip install oci
Ensure you have a valid OCI config file (usually ~/.oci/config) with:
- tenancy
- user
- fingerprint
- key_file
- region
- A profile name (e.g. DEFAULT).
Have the Compartment OCID where you want to manage logs (often the root compartment or a specific app compartment).

2. Python: Ensure Active Log Group + Create Monitoring Log

This script:

Connects using OCI SDK.
Checks if there is at least one ACTIVE log group in a given compartment.
If none exists, creates one.
Ensures a SERVICE log for the monitoring service is created and enabled in that log group.

import oci
from oci.logging import LoggingManagementClient
from oci.logging.models import CreateLogGroupDetails, CreateLogDetails

# ---------------- CONFIG ----------------
OCI_PROFILE = "DEFAULT"  # Profile in ~/.oci/config
COMPARTMENT_OCID = "<YOUR_COMPARTMENT_OCID>"  # e.g. ocid1.compartment.oc1..xxxxx
LOG_GROUP_DISPLAY_NAME = "monitoring-log-group"
MONITORING_LOG_DISPLAY_NAME = "monitoring-service-log"
# ----------------------------------------


def get_logging_client(profile_name):
    config = oci.config.from_file("~/.oci/config", profile_name)
    return LoggingManagementClient(config=config)


def get_or_create_log_group(logging_client, compartment_id, display_name):
    # List log groups in the compartment
    log_groups = logging_client.list_log_groups(
        compartment_id=compartment_id
    ).data

    # Try to find an ACTIVE log group with the desired display name
    for lg in log_groups:
        if lg.display_name == display_name and lg.lifecycle_state == "ACTIVE":
            print(f"Found active log group: {lg.display_name} ({lg.id})")
            return lg

    # If no active log group with that name, create one
    create_details = CreateLogGroupDetails(
        compartment_id=compartment_id,
        display_name=display_name,
        description="Log group for Monitoring service logs"
    )

    log_group = logging_client.create_log_group(
        create_log_group_details=create_details
    ).data

    oci.wait_until(
        client=logging_client,
        waiter_callable=logging_client.get_log_group,
        evaluate_response=lambda r: r.data.lifecycle_state == "ACTIVE",
        max_wait_seconds=300,
        log_group_id=log_group.id
    )

    print(f"Created log group: {log_group.display_name} ({log_group.id})")
    return logging_client.get_log_group(log_group.id).data


def get_or_create_monitoring_log(logging_client, log_group, display_name):
    # List existing logs in the log group
    logs = logging_client.list_logs(
        log_group_id=log_group.id
    ).data

    for log in logs:
        if log.display_name == display_name and log.lifecycle_state == "ACTIVE":
            print(f"Found active monitoring log: {log.display_name} ({log.id})")
            return log

    # Create new Monitoring SERVICE log
    create_log_details = CreateLogDetails(
        display_name=display_name,
        log_type="SERVICE",
        is_enabled=True,
        configuration={
            "source": {
                # For Monitoring service
                "category": "all",         # or more specific category as needed
                "resource": "monitoring",  # service name
                "service": "monitoring"
            }
        },
        # Optional: log retention, freeform_tags, defined_tags, etc.
    )

    log = logging_client.create_log(
        log_group_id=log_group.id,
        create_log_details=create_log_details
    ).data

    print(f"Created monitoring log: {log.display_name} ({log.id})")
    return log


def main():
    logging_client = get_logging_client(OCI_PROFILE)

    # 1. Ensure there is an active log group
    log_group = get_or_create_log_group(
        logging_client=logging_client,
        compartment_id=COMPARTMENT_OCID,
        display_name=LOG_GROUP_DISPLAY_NAME
    )

    # 2. Ensure Monitoring log is created and enabled
    _ = get_or_create_monitoring_log(
        logging_client=logging_client,
        log_group=log_group,
        display_name=MONITORING_LOG_DISPLAY_NAME
    )


if __name__ == "__main__":
    main()

3. Summary of Remediation Logic

Identify compartment where Logging should be configured.
Ensure at least one ACTIVE log group exists (create if not).
Create and enable a Monitoring SERVICE log in that log group.
This satisfies the requirement that “OCI Logging Should Have Active Log Groups” and that Monitoring is sending logs into them.

If you share your exact policy or CIS/benchmark ID, I can adjust the log config (categories, retention, etc.) to match it precisely.

Using Terraform

resource "oci_logging_log_group" "ACTIVE_LOG_GROUP" {
  # Substitute with your compartment OCID
  compartment_id = "OCID_OF_TARGET_COMPARTMENT"

  # Name and description for the log group
  display_name = "PRIMARY_LOG_GROUP"
  description  = "Log group for collecting diagnostic and security logs"

  # Ensure the log group is active
  state = "ACTIVE"

  # Optionally, set defined or freeform tags if required by your org
  # defined_tags  = { "NAMESPACE.KEY" = "VALUE" }
  # freeform_tags = { "ENV" = "PRODUCTION" }
}

This creates an active log group in the specified compartment so OCI Logging can collect and store logs. This is an additive change and does not force replacement of existing resources.After adding this, terraform plan should show one new oci_logging_log_group resource to be created (no changes or destroys to existing resources).

OCI Misconfigurations

OCI Logging Should Have Active Log Groups

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Verify Existing Log Groups

2. Create a Log Group (if missing)

3. Enable Logging for the Monitoring Service

4. Confirm Logs Are Active

0. Prerequisites

1. Check if any active log groups already exist

2. Create a log group (if none exists)

3. Enable Monitoring service logs in that log group

3.1. Identify the log you want (region/compartment specific)

3.2. Create a Monitoring service log

4. Verify the log is active

5. (Optional) Enable additional Monitoring categories

1. Prerequisites

2. Python: Ensure Active Log Group + Create Monitoring Log

3. Summary of Remediation Logic

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Verify Existing Log Groups

​2. Create a Log Group (if missing)

​3. Enable Logging for the Monitoring Service

​4. Confirm Logs Are Active

​0. Prerequisites

​1. Check if any active log groups already exist

​2. Create a log group (if none exists)

​3. Enable Monitoring service logs in that log group

​3.1. Identify the log you want (region/compartment specific)

​3.2. Create a Monitoring service log

​4. Verify the log is active

​5. (Optional) Enable additional Monitoring categories

​1. Prerequisites

​2. Python: Ensure Active Log Group + Create Monitoring Log

​3. Summary of Remediation Logic

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Verify Existing Log Groups

2. Create a Log Group (if missing)

3. Enable Logging for the Monitoring Service

4. Confirm Logs Are Active

0. Prerequisites

1. Check if any active log groups already exist

2. Create a log group (if none exists)

3. Enable Monitoring service logs in that log group

3.1. Identify the log you want (region/compartment specific)

3.2. Create a Monitoring service log

4. Verify the log is active

5. (Optional) Enable additional Monitoring categories

1. Prerequisites

2. Python: Ensure Active Log Group + Create Monitoring Log

3. Summary of Remediation Logic