> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI Logging Service Should Have Active Logs Configured ### More Info: The OCI Logging service should have active log groups with enabled logs. Without active logging, security events, errors, and operational issues go unrecorded. ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * FedRAMP * GDPR * HIPAA * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Here’s how to remediate **“OCI Logging Service Should Have Active Logs Configured”** by enabling **service logs** for the Logging service using the OCI Console: *** ### 1. Sign in and choose the right compartment 1. Sign in to the **OCI Console**. 2. In the top-left, open the **Navigation Menu**. 3. Make sure you’ve selected the **correct region** (top-right). 4. In the **Compartment selector** (left side, above the main pane), choose the **compartment** where you want the Logging service logs to live (often a central “logging” or “security” compartment). *** ### 2. Go to Service Logs 1. From the Navigation Menu, go to:\ **Observability & Management → Logging → Service Logs**. *** ### 3. Enable Logging service logs 1. On the **Service Logs** page, click **Enable service logs** (or **Create service log** if you already have some). 2. In the wizard: * **Service**: select **Logging**. * **Resource**: choose the relevant resource scope, for example: * `tenancy`, or * specific resources (like log groups or logging resources) as appropriate to your environment. * **Category**: select the categories you want (for the CIS-style requirement, enable all relevant categories such as: * `ingestion` * `search` * any other offered Logging categories for your tenancy). * **Enable log**: ensure the log is set to **Enabled / Active**. 3. **Log Group**: * Either select an existing **Log Group** (recommended: a central one like `security-logs` or `platform-logs`), or * Click **Create new log group**, give it a name and (optionally) description, and save. 4. **Log Name and Details**: * Specify a **Log name** (e.g., `logging-service-ingestion-log`). * Set **Log retention period** according to your policy (e.g., 90 or 365 days). * Leave **Configuration** at default unless you need custom settings. 5. Click **Create** (or **Enable**) to finalize. Repeat steps 1–5 for each **Logging** service log **category** you want enabled to satisfy the “active logs configured” requirement. *** ### 4. Verify logs are active 1. Back on **Observability & Management → Logging → Service Logs**: * Filter by **Service = Logging** and your **Compartment**. * Confirm each required category shows **Status: Enabled / Active**. 2. Optionally, generate some Logging activity (e.g., create/modify a log group or log) and: * Go to **Observability & Management → Logging → Logs**. * Open the log you created and check if new entries appear. This ensures the **OCI Logging service** has **active service logs configured**, resolving the misconfiguration for OCI Logging Monitoring via the console. Below are the steps to ensure the **OCI Logging service has active logs configured for the Monitoring service**, using the **OCI CLI**. Assumptions: * You already have OCI CLI installed and configured (`oci setup config` done). * You know your **compartment OCID**. *** ## 1. Set common variables (optional but recommended) ```bash theme={null} export COMPARTMENT_OCID="" export REGION="" # e.g., us-phoenix-1 export LOG_GROUP_NAME="monitoring-logs-group" export LOG_NAME="monitoring-service-log" ``` *** ## 2. Create a Log Group (if you don’t have one) ```bash theme={null} oci logging log-group create \ --compartment-id "$COMPARTMENT_OCID" \ --display-name "$LOG_GROUP_NAME" \ --region "$REGION" ``` Get the **log group OCID** from the command output or list them: ```bash theme={null} oci logging log-group list \ --compartment-id "$COMPARTMENT_OCID" \ --region "$REGION" \ --all \ --query "data[?\"display-name\"=='$LOG_GROUP_NAME'].id | [0]" \ --raw-output ``` Save it: ```bash theme={null} export LOG_GROUP_OCID="" ``` *** ## 3. Create an Active Service Log for Monitoring Create a **service log** for the Monitoring service and enable it: ```bash theme={null} oci logging log create \ --log-group-id "$LOG_GROUP_OCID" \ --display-name "$LOG_NAME" \ --is-enabled true \ --log-type "SERVICE" \ --configuration '{ "source": { "sourceType": "OCISERVICE", "service": "monitoring" } }' \ --region "$REGION" ``` Notes: * `--log-type "SERVICE"` is required for service logs. * `"service": "monitoring"` is the key part that enables logs **for the Monitoring service**. *** ## 4. Verify the Log is Active ```bash theme={null} oci logging log list \ --log-group-id "$LOG_GROUP_OCID" \ --region "$REGION" \ --all ``` Check that: * The log you created is present. * `"is-enabled": true` * `"logType": "SERVICE"` * `"service": "monitoring"` in `configuration.source`. *** If you share your exact compartment OCID and region (sanitized as needed), I can return fully filled example commands you can copy-paste. Below is a practical, step‑by‑step way to ensure **OCI Logging** has active logs configured for the **Monitoring** service, using **Python** and the OCI SDK. I’ll assume: * You already have an OCI tenancy and permissions to manage logging. * You want to enable **service logs** for the **Monitoring** service in a given compartment. *** ## 1. Install and Configure the OCI Python SDK ```bash theme={null} pip install oci ``` Make sure your `~/.oci/config` file is set up (or use instance principal / resource principal as needed): ```ini theme={null} [DEFAULT] user=ocid1.user.oc1..aaaa... fingerprint=xx:xx:... key_file=/path/to/oci_api_key.pem tenancy=ocid1.tenancy.oc1..aaaa... region=eu-frankfurt-1 ``` *** ## 2. Decide the Target Compartment and Log Group You need: * `compartment_id` where Monitoring is being used. * Either: * an existing **Log Group OCID**, or * a **name** to create a new log group. *** ## 3. Python Script: Ensure Log Group Exists and Enable Monitoring Service Log Below is a minimal example that: 1. Ensures a log group exists in the compartment. 2. Creates a **Monitoring** service log if it does not exist. 3. Ensures it is **enabled**. ```python theme={null} import oci from oci.logging.models import CreateLogGroupDetails, CreateLogDetails, UpdateLogDetails config = oci.config.from_file("~/.oci/config", "DEFAULT") logging_client = oci.logging.LoggingManagementClient(config) # --------- CONFIGURE THESE VALUES ---------- compartment_id = "ocid1.compartment.oc1..xxxx" log_group_name = "monitoring-logs" log_display_name = "MonitoringServiceLog" # Monitoring service name and category for service logs: service_name = "monitoring" # OCI service name category = "api" # typical category; adjust as needed ("api", "audit", etc.) # ------------------------------------------- def get_or_create_log_group(compartment_id, log_group_name): # Try to find an existing log group list_resp = logging_client.list_log_groups( compartment_id=compartment_id, display_name=log_group_name, lifecycle_state="ACTIVE" ) if list_resp.data: return list_resp.data[0] # Create if not found details = CreateLogGroupDetails( compartment_id=compartment_id, display_name=log_group_name, description="Log group for Monitoring service logs" ) create_resp = logging_client.create_log_group(details) oci.wait_until( logging_client, logging_client.get_log_group(create_resp.data.id), 'lifecycle_state', 'ACTIVE' ) return create_resp.data def get_log_by_display_name(log_group_id, log_display_name): list_resp = logging_client.list_logs( log_group_id=log_group_id, display_name=log_display_name ) if list_resp.data: return list_resp.data[0] return None def create_monitoring_service_log(log_group_id, log_display_name): details = CreateLogDetails( display_name=log_display_name, log_type="SERVICE", # Service log is_enabled=True, configuration={ "source": { "service": service_name, "category": category, # For many services, resource can be left empty to capture all, # or set to specific resource OCID if required. "resource": "" }, "compartmentId": compartment_id } ) create_resp = logging_client.create_log( log_group_id=log_group_id, create_log_details=details ) oci.wait_until( logging_client, logging_client.get_log(log_group_id, create_resp.data.id), 'lifecycle_state', 'ACTIVE' ) return create_resp.data def ensure_log_enabled(log_group_id, log): if not log.is_enabled: update_details = UpdateLogDetails(is_enabled=True) logging_client.update_log( log_group_id=log_group_id, log_id=log.id, update_log_details=update_details ) def main(): # 1. Ensure log group exists log_group = get_or_create_log_group(compartment_id, log_group_name) log_group_id = log_group.id # 2. Ensure Monitoring service log exists log = get_log_by_display_name(log_group_id, log_display_name) if log is None: log = create_monitoring_service_log(log_group_id, log_display_name) # 3. Ensure it is enabled ensure_log_enabled(log_group_id, log) print(f"Monitoring service log is active and enabled in log group {log_group.display_name}.") if __name__ == "__main__": main() ``` *** ## 4. Notes / Adjustments * **Category**:\ For Monitoring, common categories are typically `"api"` or `"service"`, but this can vary by region/feature.\ You can list available categories via CLI/UI or documentation and adjust the `category` variable. * **Resource**: * Leave `resource` empty (`""`) to log all Monitoring resources in that compartment (where supported). * Or specify a specific OCID (e.g., an alarm OCID) if you want per-resource logging. * **Multiple Compartments / Regions**: * Loop the above logic across compartments/regions if you want all of them covered. This pattern remediates the finding “OCI Logging Service Should Have Active Logs Configured” by ensuring there is an **active, enabled service log for the Monitoring service** in the target compartment. ```hcl theme={null} # Create an active log group for Audit logs resource "oci_logging_log_group" "AUDIT_LOG_GROUP" { # Replace with the OCID of the compartment where you want the log group compartment_id = "OCID_OF_TARGET_COMPARTMENT" display_name = "audit-log-group" description = "Log group for tenancy audit logs" } # Create an enabled log in that group for the Audit service resource "oci_logging_log" "AUDIT_LOG" { log_group_id = oci_logging_log_group.AUDIT_LOG_GROUP.id display_name = "tenancy-audit-log" description = "Active log for Audit events" # Ensure the log is enabled is_enabled = true log_type = "SERVICE" configuration { source { # For Audit service logs category = "audit" service = "audit" # Replace with the OCID of the target resource if you want to scope, # or omit `resource` to collect at the compartment/tenancy level # resource = "OCID_OF_TARGET_RESOURCE" } # Optional: configure log retention in days # retention_duration = 90 } # Replace with the OCID of the compartment where this log should live compartment_id = "OCID_OF_TARGET_COMPARTMENT" } ``` Substitute: * `OCID_OF_TARGET_COMPARTMENT` with the compartment OCID where you want to store the log group/log. * Optionally set `resource` inside `configuration.source` if you need to scope logs to a specific resource. This change does not replace existing resources; it adds a new log group and an enabled log. For Monitoring service logs instead of Audit, keep the same structure but set: * `service = "monitoring"` * `category` to an appropriate Monitoring log category. Verification: `terraform plan` should show `+` (create) for `oci_logging_log_group.AUDIT_LOG_GROUP` and `oci_logging_log.AUDIT_LOG` with `is_enabled = true`.