> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI Logging Should Have Active Log Groups ### More Info: At least one active log group should exist in the compartment. Without log groups, the OCI Logging service cannot collect and store diagnostic and security logs. ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * FedRAMP * GDPR * HIPAA * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Below are the steps to ensure OCI Logging has active log groups for Monitoring, using the OCI Console. *** ### 1. Verify Existing Log Groups 1. Sign in to the **OCI Console**. 2. In the left hamburger menu, go to\ **Observability & Management → Logging → Log groups**. 3. Select the **correct compartment** (top-left of the page). 4. Check if any **Log groups** exist and are in **Active** state. * If none exist, proceed to create one. *** ### 2. Create a Log Group (if missing) 1. On the **Log groups** page, click **Create log group**. 2. Fill in: * **Name**: e.g. `monitoring-log-group`. * **Description**: optional. * **Compartment**: choose the compartment where Monitoring resources reside. 3. Click **Create**.\ Ensure the new log group status is **Active**. *** ### 3. Enable Logging for the Monitoring Service 1. In the menu, go to\ **Observability & Management → Logging → Logs**. 2. Make sure you’re in the same **compartment** and **region** as your Monitoring resources. 3. Click **Create custom log** (or **Enable service log**, depending on the UI version): * **Log group**: select the active log group you created (e.g. `monitoring-log-group`). * **Log name**: e.g. `monitoring-service-log`. * **Log source / Resource**: choose **Service logs** and then select the **Monitoring** service (and specific resource type if required). 4. Configure any additional options (retention, filters) as needed. 5. Click **Create** or **Enable** to activate the log. *** ### 4. Confirm Logs Are Active 1. Still under **Logging → Logs**, verify: * The log is listed. * Status is **Active**. 2. Optionally, generate some Monitoring activity (e.g., create/modify an alarm) and: * Open the log. * Use **Search** to confirm events are being recorded. This ensures OCI Logging has at least one active log group and active logs tied to the Monitoring service. To fix “OCI Logging Should Have Active Log Groups” for Monitoring logs using the OCI CLI, you need to: 1. Ensure there is at least one **active log group** in the target compartment. 2. Enable **service logs for Monitoring** into that log group. Below are step‑by‑step CLI instructions. *** ## 0. Prerequisites * OCI CLI installed and configured (`oci setup config`) * Values ready: * `TENANCY_OCID` * `COMPARTMENT_OCID` (where you want the log group and logs) * `REGION` (e.g., `us-ashburn-1`) You can set defaults: ```bash theme={null} export OCI_CLI_PROFILE=DEFAULT export OCI_CLI_REGION=us-ashburn-1 ``` *** ## 1. Check if any active log groups already exist ```bash theme={null} oci logging log-group list \ --compartment-id \ --all ``` * If you see a log group with `"lifecycle-state": "ACTIVE"` you can reuse it. * Note its `id` (log group OCID). If none exist, create one. *** ## 2. Create a log group (if none exists) ```bash theme={null} oci logging log-group create \ --compartment-id \ --display-name "monitoring-log-group" \ --description "Log group for OCI Monitoring service logs" ``` Capture the log group OCID from the output: ```bash theme={null} LOG_GROUP_ID= ``` If you already had one, just set: ```bash theme={null} LOG_GROUP_ID= ``` *** ## 3. Enable Monitoring service logs in that log group OCI Monitoring writes service logs under the Logging service. You enable a service log with `oci logging log create` using `--source-service monitoring`. ### 3.1. Identify the log you want (region/compartment specific) For basic Monitoring service activity logs, a common pattern is: * `source-service`: `monitoring` * `source-resource`: usually the compartment or tenancy (for tenancy‑level logs) * `category` and `service-logs` differ by region/service version; a simple way is to list available service categories: ```bash theme={null} oci logging log list \ --log-group-id $LOG_GROUP_ID \ --all ``` If you don’t have any yet (likely), you create one explicitly: ### 3.2. Create a Monitoring service log Example: enable Monitoring service log at tenancy scope (replace with compartment if needed): ```bash theme={null} oci logging log create \ --log-group-id $LOG_GROUP_ID \ --display-name "oci-monitoring-service-log" \ --log-type SERVICE \ --is-enabled true \ --configuration '{ "source": { "category": "api", "resource": "", "service": "monitoring", "serviceType": "oci" } }' ``` Notes: * `category` may vary by region/tenant (`api`, `workrequests`, etc.). If `api` fails, check documentation or UI for available categories for Monitoring in your region. * If you want logs scoped to a compartment instead of tenancy: ```bash theme={null} "resource": "" ``` *** ## 4. Verify the log is active ```bash theme={null} oci logging log list \ --log-group-id $LOG_GROUP_ID \ --all ``` Check that: * `lifecycle-state` is `ACTIVE` * `is-enabled` is `true` *** ## 5. (Optional) Enable additional Monitoring categories If you need more than one category (e.g., `api`, `workrequests`), repeat step 3.2 with another `display-name` and `category`. *** Once you have at least one `ACTIVE` log group and at least one `ENABLED` Monitoring service log in it, the “OCI Logging Should Have Active Log Groups” finding for Monitoring should be remediated. Below is a minimal, step‑by‑step approach to ensure OCI Logging has at least one *active* log group, and to programmatically create and enable a log for **Monitoring** using Python. *** ## 1. Prerequisites 1. Install OCI Python SDK: ```bash theme={null} pip install oci ``` 2. Ensure you have a valid OCI config file (usually `~/.oci/config`) with: * tenancy * user * fingerprint * key\_file * region * A profile name (e.g. `DEFAULT`). 3. Have the **Compartment OCID** where you want to manage logs (often the root compartment or a specific app compartment). *** ## 2. Python: Ensure Active Log Group + Create Monitoring Log This script: * Connects using OCI SDK. * Checks if there is at least one **ACTIVE** log group in a given compartment. * If none exists, creates one. * Ensures a **SERVICE** log for the **monitoring** service is created and enabled in that log group. ```python theme={null} import oci from oci.logging import LoggingManagementClient from oci.logging.models import CreateLogGroupDetails, CreateLogDetails # ---------------- CONFIG ---------------- OCI_PROFILE = "DEFAULT" # Profile in ~/.oci/config COMPARTMENT_OCID = "" # e.g. ocid1.compartment.oc1..xxxxx LOG_GROUP_DISPLAY_NAME = "monitoring-log-group" MONITORING_LOG_DISPLAY_NAME = "monitoring-service-log" # ---------------------------------------- def get_logging_client(profile_name): config = oci.config.from_file("~/.oci/config", profile_name) return LoggingManagementClient(config=config) def get_or_create_log_group(logging_client, compartment_id, display_name): # List log groups in the compartment log_groups = logging_client.list_log_groups( compartment_id=compartment_id ).data # Try to find an ACTIVE log group with the desired display name for lg in log_groups: if lg.display_name == display_name and lg.lifecycle_state == "ACTIVE": print(f"Found active log group: {lg.display_name} ({lg.id})") return lg # If no active log group with that name, create one create_details = CreateLogGroupDetails( compartment_id=compartment_id, display_name=display_name, description="Log group for Monitoring service logs" ) log_group = logging_client.create_log_group( create_log_group_details=create_details ).data oci.wait_until( client=logging_client, waiter_callable=logging_client.get_log_group, evaluate_response=lambda r: r.data.lifecycle_state == "ACTIVE", max_wait_seconds=300, log_group_id=log_group.id ) print(f"Created log group: {log_group.display_name} ({log_group.id})") return logging_client.get_log_group(log_group.id).data def get_or_create_monitoring_log(logging_client, log_group, display_name): # List existing logs in the log group logs = logging_client.list_logs( log_group_id=log_group.id ).data for log in logs: if log.display_name == display_name and log.lifecycle_state == "ACTIVE": print(f"Found active monitoring log: {log.display_name} ({log.id})") return log # Create new Monitoring SERVICE log create_log_details = CreateLogDetails( display_name=display_name, log_type="SERVICE", is_enabled=True, configuration={ "source": { # For Monitoring service "category": "all", # or more specific category as needed "resource": "monitoring", # service name "service": "monitoring" } }, # Optional: log retention, freeform_tags, defined_tags, etc. ) log = logging_client.create_log( log_group_id=log_group.id, create_log_details=create_log_details ).data print(f"Created monitoring log: {log.display_name} ({log.id})") return log def main(): logging_client = get_logging_client(OCI_PROFILE) # 1. Ensure there is an active log group log_group = get_or_create_log_group( logging_client=logging_client, compartment_id=COMPARTMENT_OCID, display_name=LOG_GROUP_DISPLAY_NAME ) # 2. Ensure Monitoring log is created and enabled _ = get_or_create_monitoring_log( logging_client=logging_client, log_group=log_group, display_name=MONITORING_LOG_DISPLAY_NAME ) if __name__ == "__main__": main() ``` *** ## 3. Summary of Remediation Logic 1. **Identify compartment** where Logging should be configured. 2. **Ensure at least one ACTIVE log group** exists (create if not). 3. **Create and enable a Monitoring SERVICE log** in that log group. 4. This satisfies the requirement that “OCI Logging Should Have Active Log Groups” and that Monitoring is sending logs into them. If you share your exact policy or CIS/benchmark ID, I can adjust the log config (categories, retention, etc.) to match it precisely. ```hcl theme={null} resource "oci_logging_log_group" "ACTIVE_LOG_GROUP" { # Substitute with your compartment OCID compartment_id = "OCID_OF_TARGET_COMPARTMENT" # Name and description for the log group display_name = "PRIMARY_LOG_GROUP" description = "Log group for collecting diagnostic and security logs" # Ensure the log group is active state = "ACTIVE" # Optionally, set defined or freeform tags if required by your org # defined_tags = { "NAMESPACE.KEY" = "VALUE" } # freeform_tags = { "ENV" = "PRODUCTION" } } ``` This creates an active log group in the specified compartment so OCI Logging can collect and store logs. This is an additive change and does not force replacement of existing resources. After adding this, `terraform plan` should show one new `oci_logging_log_group` resource to be created (no changes or destroys to existing resources).