Skip to main content

OCI Logging Audit Retention Should Be At Least 90 Days

More Info:​

Audit logs should be retained for at least 90 days. Insufficient retention limits the ability to investigate security incidents that may not be detected immediately

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Here’s how to set OCI Logging retention to at least 90 days for Monitoring logs using the OCI Console:

  1. Sign in & choose the correct compartment

    • Log in to the OCI Console.
    • At the top-left, select the Compartment where your Monitoring logs are located.

  2. Open Logging

    • In the left-side menu, go to:
      Observability & Management → Logging → Log Groups.

  3. Select the relevant Log Group

    • In your chosen compartment, click the Log Group that contains your Monitoring logs (for example, monitoring-log-group, or where you configured Monitoring service logs).

  4. Open the Monitoring Log

    • Inside the log group, go to the Logs tab.
    • Locate the Monitoring log (Type will usually be “Service” and Source something like monitoring).
    • Click the name of that log.

  5. Edit the retention period

    • On the log details page, click Edit (or Edit Log).
    • Find the Retention period setting.
    • Change it to 90 days or higher (e.g., 90, 180, etc.).

  6. Save the changes

    • Click Save changes.
    • Confirm the update if prompted.

  7. Repeat for other Monitoring logs / compartments

    • If you have multiple Monitoring logs in other log groups or compartments, repeat the steps so that each relevant Monitoring log has a retention of ≥ 90 days.

This updates the retention for Monitoring logs in the OCI Logging service to meet the 90‑day requirement.

Using CLI

Here’s how to set at least 90 days retention for OCI Logging (Monitoring logs) using the OCI CLI.

Note: In OCI, retention is set on the log group, not the individual log. So you must update the log group where your Monitoring logs are stored.

1. Identify the Log Group for Monitoring Logs​

If you already know the log group OCID, skip to step 2.

List log groups in the compartment where your Monitoring logs reside:

oci logging log-group list \
  --compartment-id <COMPARTMENT_OCID>

Find the id of the log group that contains your Monitoring logs
(e.g., id: "ocid1.loggroup.oc1....").

If you need to confirm which logs are Monitoring logs in that group:

oci logging log list \
  --log-group-id <LOG_GROUP_OCID>

Look for logs where source_service is oci_monitoring or similar.

2. Check Current Retention on the Log Group​

oci logging log-group get \
  --log-group-id <LOG_GROUP_OCID>

In the output, check the retention-duration (in days).

3. Update Retention to at Least 90 Days​

Set retention to 90 days (or higher if you prefer):

oci logging log-group update \
  --log-group-id <LOG_GROUP_OCID> \
  --retention-duration 90

You can also use a higher value, e.g., --retention-duration 180.

4. Verify the Change​

oci logging log-group get \
  --log-group-id <LOG_GROUP_OCID> \
  --query "data.retention-duration"

Ensure the returned value is >= 90.

If You Also Need Audit Log Retention (Root Tenancy)​

For Audit service retention at the tenancy level:

oci audit-configuration update \
  --compartment-id <TENANCY_OCID> \
  --retention-period-days 90

Verify:

oci audit-configuration get \
  --compartment-id <TENANCY_OCID> \
  --query "data.retention-period-days"
Using Python

Below is how to remediate this with Python using the OCI SDK by updating log retention to at least 90 days for Monitoring-related logs in OCI Logging.

1. Prerequisites​

  1. Install the SDK:
pip install oci
  1. Configure your OCI CLI credentials (if not already):
oci setup config

This creates ~/.oci/config with your tenancy, user OCID, key, etc.

2. Concept: What You Actually Change​

Retention is set per log in the Logging service.

  • Resource: Log (under a LogGroup)
  • Field: retention_in_days
  • API: LoggingManagementClient.update_log

You need to:

  1. Find the right log group(s) and log(s) (e.g., logs for Monitoring / Audit).
  2. For each log, check retention_in_days.
  3. If < 90, update it to 90 (or more).

3. Python Example: Set Retention for Monitoring Logs to ≥ 90 Days​

This script:

  • Uses your default OCI profile.
  • Works in one region (set in your config).
  • Searches all log groups in a compartment.
  • For each log where source_service == "monitoring" (i.e., Monitoring service logs), sets retention to 90 if it’s currently lower.
import oci

# ----------------------------
# Configuration
# ----------------------------
CONFIG_PROFILE = "DEFAULT"      # or another profile name
COMPARTMENT_OCID = "<your_compartment_ocid>"
MIN_RETENTION_DAYS = 90

# ----------------------------
# Setup clients
# ----------------------------
config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE)
logging_client = oci.logging.LoggingManagementClient(config)

# ----------------------------
# Helper: list all log groups in a compartment
# ----------------------------
def list_log_groups(compartment_id):
    log_groups = []
    list_call = logging_client.list_log_groups(
        compartment_id=compartment_id
    )
    log_groups.extend(list_call.data)

    while list_call.has_next_page:
        list_call = logging_client.list_log_groups(
            compartment_id=compartment_id,
            page=list_call.next_page
        )
        log_groups.extend(list_call.data)
    return log_groups

# ----------------------------
# Helper: list all logs in a log group
# ----------------------------
def list_logs(log_group_id):
    logs = []
    list_call = logging_client.list_logs(
        log_group_id=log_group_id
    )
    logs.extend(list_call.data)

    while list_call.has_next_page:
        list_call = logging_client.list_logs(
            log_group_id=log_group_id,
            page=list_call.next_page
        )
        logs.extend(list_call.data)
    return logs

# ----------------------------
# Main: update retention for Monitoring logs
# ----------------------------
def ensure_monitoring_logs_retention(compartment_id, min_days):
    log_groups = list_log_groups(compartment_id)
    print(f"Found {len(log_groups)} log groups")

    for lg in log_groups:
        print(f"\nChecking log group: {lg.display_name} ({lg.id})")
        logs = list_logs(lg.id)

        for log in logs:
            # Filter to Monitoring service logs
            # For service logs, source_service will be set to the OCI service, e.g., "monitoring"
            source_service = getattr(log, "source_service", None)
            if source_service is None or source_service.lower() != "monitoring":
                continue

            current_retention = log.retention_in_days
            print(f"  Log: {log.display_name} ({log.id}) | current retention: {current_retention} days")

            if current_retention is None or current_retention < min_days:
                print(f"    -> Updating retention to {min_days} days")
                update_details = oci.logging.models.UpdateLogDetails(
                    retention_in_days=min_days
                )

                response = logging_client.update_log(
                    log_group_id=lg.id,
                    log_id=log.id,
                    update_log_details=update_details
                )
                print(f"    Updated. New retention: {response.data.retention_in_days} days")
            else:
                print("    Retention already compliant, no change")

if __name__ == "__main__":
    ensure_monitoring_logs_retention(COMPARTMENT_OCID, MIN_RETENTION_DAYS)

4. Adapting This for “Audit” Logs in Logging (If You’re Shipping Audit → Logging)​

If your organization forwards Audit events into Logging (e.g., via Service Connector):

  • Change the filter to match how you identify those logs, e.g.:
    • By source_service == "audit", or
    • By log_type == "SERVICE" and log.display_name pattern, etc.

Example filter tweak:

# For Audit logs instead of Monitoring:
if source_service is None or source_service.lower() != "audit":
    continue

5. If You Actually Meant Native OCI Audit Service Retention​

If the requirement is specifically “Audit logs retention ≥ 90 days” using the Audit service (not Logging), you must:

  • Use oci.audit.AuditClient.update_configuration.
  • Set retention_period_days in the Audit configuration for the tenancy/compartment.

Minimal example:

import oci

CONFIG_PROFILE = "DEFAULT"
COMPARTMENT_OCID = "<your_tenancy_or_compartment_ocid>"
MIN_RETENTION_DAYS = 90

config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE)
audit_client = oci.audit.AuditClient(config)

current_conf = audit_client.get_configuration(COMPARTMENT_OCID).data
if current_conf.retention_period_days < MIN_RETENTION_DAYS:
    details = oci.audit.models.UpdateConfigurationDetails(
        retention_period_days=MIN_RETENTION_DAYS
    )
    resp = audit_client.update_configuration(
        compartment_id=COMPARTMENT_OCID,
        update_configuration_details=details
    )
    print("Updated Audit retention to:", resp.data.retention_period_days)
else:
    print("Audit retention already compliant")

If you clarify whether your “Audit” logs are:

  • native Audit service logs, or
  • logs in Logging sourced from Audit/Monitoring,

I can narrow this down to exactly one final script for your setup.

Using Terraform
# Configure Audit log retention for the tenancy (or target compartment)
resource "oci_audit_configuration" "audit_retention" {
  # Replace with the OCID of the tenancy or compartment whose Audit config you are managing.
  # For global Audit configuration, this is typically the tenancy OCID.
  compartment_id        = "OCID_OF_TENANCY_OR_TARGET_COMPARTMENT"

  # Set retention to at least 90 days, per the requirement.
  retention_period_days = 90
}

Changing retention_period_days does not force resource replacement; it updates in place.

To verify, terraform plan should show the existing retention_period_days changing from its current value (e.g., 30) to 90:

~ resource "oci_audit_configuration" "audit_retention" {
      retention_period_days = 30 -> 90
  }