OCI Logging Service Should Have Active Logs Configured

More Info:

The OCI Logging service should have active log groups with enabled logs. Without active logging, security events, errors, and operational issues go unrecorded.

Risk Level

Medium

Address

Compliance, Security

Compliance Standards

APRA CPS 234 (Australia)
AWS Well Architected Framework
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS AWS
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
FedRAMP
GDPR
HIPAA
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST
NIST CSF
NIST SP 800-171
NYDFS 23 NYCRR 500
PCI
Reserve Bank of India (RBI) Cyber Security Framework
Reserve Bank of India (RBI) Master Direction – Information Technology Framework
SOC2
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Here’s how to remediate “OCI Logging Service Should Have Active Logs Configured” by enabling service logs for the Logging service using the OCI Console:

Sign in to the OCI Console.
In the top-left, open the Navigation Menu.
Make sure you’ve selected the correct region (top-right).
In the Compartment selector (left side, above the main pane), choose the compartment where you want the Logging service logs to live (often a central “logging” or “security” compartment).

2. Go to Service Logs

From the Navigation Menu, go to:
Observability & Management → Logging → Service Logs.

3. Enable Logging service logs

On the Service Logs page, click Enable service logs (or Create service log if you already have some).
In the wizard:
- Service: select Logging.
- Resource: choose the relevant resource scope, for example:
  - tenancy, or
  - specific resources (like log groups or logging resources) as appropriate to your environment.
- Category: select the categories you want (for the CIS-style requirement, enable all relevant categories such as:
  - ingestion
  - search
  - any other offered Logging categories for your tenancy).
- Enable log: ensure the log is set to Enabled / Active.
Log Group:
- Either select an existing Log Group (recommended: a central one like security-logs or platform-logs), or
- Click Create new log group, give it a name and (optionally) description, and save.
Log Name and Details:
- Specify a Log name (e.g., logging-service-ingestion-log).
- Set Log retention period according to your policy (e.g., 90 or 365 days).
- Leave Configuration at default unless you need custom settings.
Click Create (or Enable) to finalize.

Repeat steps 1–5 for each Logging service log category you want enabled to satisfy the “active logs configured” requirement.

4. Verify logs are active

Back on Observability & Management → Logging → Service Logs:
- Filter by Service = Logging and your Compartment.
- Confirm each required category shows Status: Enabled / Active.
Optionally, generate some Logging activity (e.g., create/modify a log group or log) and:
- Go to Observability & Management → Logging → Logs.
- Open the log you created and check if new entries appear.

This ensures the OCI Logging service has active service logs configured, resolving the misconfiguration for OCI Logging Monitoring via the console.

Using CLI

Below are the steps to ensure the OCI Logging service has active logs configured for the Monitoring service, using the OCI CLI.

Assumptions:

You already have OCI CLI installed and configured (oci setup config done).
You know your compartment OCID.

1. Set common variables (optional but recommended)

export COMPARTMENT_OCID="<your_compartment_ocid>"
export REGION="<your_region>"          # e.g., us-phoenix-1
export LOG_GROUP_NAME="monitoring-logs-group"
export LOG_NAME="monitoring-service-log"

2. Create a Log Group (if you don’t have one)

oci logging log-group create \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$LOG_GROUP_NAME" \
  --region "$REGION"

Get the log group OCID from the command output or list them:

oci logging log-group list \
  --compartment-id "$COMPARTMENT_OCID" \
  --region "$REGION" \
  --all \
  --query "data[?\"display-name\"=='$LOG_GROUP_NAME'].id | [0]" \
  --raw-output

Save it:

export LOG_GROUP_OCID="<log_group_ocid_from_above>"

3. Create an Active Service Log for Monitoring

Create a service log for the Monitoring service and enable it:

oci logging log create \
  --log-group-id "$LOG_GROUP_OCID" \
  --display-name "$LOG_NAME" \
  --is-enabled true \
  --log-type "SERVICE" \
  --configuration '{
    "source": {
      "sourceType": "OCISERVICE",
      "service": "monitoring"
    }
  }' \
  --region "$REGION"

Notes:

--log-type "SERVICE" is required for service logs.
"service": "monitoring" is the key part that enables logs for the Monitoring service.

4. Verify the Log is Active

oci logging log list \
  --log-group-id "$LOG_GROUP_OCID" \
  --region "$REGION" \
  --all

Check that:

The log you created is present.
"is-enabled": true
"logType": "SERVICE"
"service": "monitoring" in configuration.source.

If you share your exact compartment OCID and region (sanitized as needed), I can return fully filled example commands you can copy-paste.

Using Python

Below is a practical, step‑by‑step way to ensure OCI Logging has active logs configured for the Monitoring service, using Python and the OCI SDK.

I’ll assume:

You already have an OCI tenancy and permissions to manage logging.
You want to enable service logs for the Monitoring service in a given compartment.

1. Install and Configure the OCI Python SDK

pip install oci

Make sure your ~/.oci/config file is set up (or use instance principal / resource principal as needed):

[DEFAULT]
user=ocid1.user.oc1..aaaa...
fingerprint=xx:xx:...
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..aaaa...
region=eu-frankfurt-1

2. Decide the Target Compartment and Log Group

You need:

compartment_id where Monitoring is being used.
Either:
- an existing Log Group OCID, or
- a name to create a new log group.

3. Python Script: Ensure Log Group Exists and Enable Monitoring Service Log

Below is a minimal example that:

Ensures a log group exists in the compartment.
Creates a Monitoring service log if it does not exist.
Ensures it is enabled.

import oci
from oci.logging.models import CreateLogGroupDetails, CreateLogDetails, UpdateLogDetails

config = oci.config.from_file("~/.oci/config", "DEFAULT")

logging_client = oci.logging.LoggingManagementClient(config)

# --------- CONFIGURE THESE VALUES ----------
compartment_id = "ocid1.compartment.oc1..xxxx"
log_group_name = "monitoring-logs"
log_display_name = "MonitoringServiceLog"
# Monitoring service name and category for service logs:
service_name = "monitoring"      # OCI service name
category = "api"                 # typical category; adjust as needed ("api", "audit", etc.)
# -------------------------------------------

def get_or_create_log_group(compartment_id, log_group_name):
    # Try to find an existing log group
    list_resp = logging_client.list_log_groups(
        compartment_id=compartment_id,
        display_name=log_group_name,
        lifecycle_state="ACTIVE"
    )

    if list_resp.data:
        return list_resp.data[0]

    # Create if not found
    details = CreateLogGroupDetails(
        compartment_id=compartment_id,
        display_name=log_group_name,
        description="Log group for Monitoring service logs"
    )
    create_resp = logging_client.create_log_group(details)
    oci.wait_until(
        logging_client,
        logging_client.get_log_group(create_resp.data.id),
        'lifecycle_state',
        'ACTIVE'
    )
    return create_resp.data

def get_log_by_display_name(log_group_id, log_display_name):
    list_resp = logging_client.list_logs(
        log_group_id=log_group_id,
        display_name=log_display_name
    )
    if list_resp.data:
        return list_resp.data[0]
    return None

def create_monitoring_service_log(log_group_id, log_display_name):
    details = CreateLogDetails(
        display_name=log_display_name,
        log_type="SERVICE",  # Service log
        is_enabled=True,
        configuration={
            "source": {
                "service": service_name,
                "category": category,
                # For many services, resource can be left empty to capture all,
                # or set to specific resource OCID if required.
                "resource": ""
            },
            "compartmentId": compartment_id
        }
    )

    create_resp = logging_client.create_log(
        log_group_id=log_group_id,
        create_log_details=details
    )
    oci.wait_until(
        logging_client,
        logging_client.get_log(log_group_id, create_resp.data.id),
        'lifecycle_state',
        'ACTIVE'
    )
    return create_resp.data

def ensure_log_enabled(log_group_id, log):
    if not log.is_enabled:
        update_details = UpdateLogDetails(is_enabled=True)
        logging_client.update_log(
            log_group_id=log_group_id,
            log_id=log.id,
            update_log_details=update_details
        )

def main():
    # 1. Ensure log group exists
    log_group = get_or_create_log_group(compartment_id, log_group_name)
    log_group_id = log_group.id

    # 2. Ensure Monitoring service log exists
    log = get_log_by_display_name(log_group_id, log_display_name)
    if log is None:
        log = create_monitoring_service_log(log_group_id, log_display_name)

    # 3. Ensure it is enabled
    ensure_log_enabled(log_group_id, log)
    print(f"Monitoring service log is active and enabled in log group {log_group.display_name}.")

if __name__ == "__main__":
    main()

4. Notes / Adjustments

Category:
For Monitoring, common categories are typically "api" or "service", but this can vary by region/feature.
You can list available categories via CLI/UI or documentation and adjust the category variable.
Resource:
- Leave resource empty ("") to log all Monitoring resources in that compartment (where supported).
- Or specify a specific OCID (e.g., an alarm OCID) if you want per-resource logging.
Multiple Compartments / Regions:
- Loop the above logic across compartments/regions if you want all of them covered.

This pattern remediates the finding “OCI Logging Service Should Have Active Logs Configured” by ensuring there is an active, enabled service log for the Monitoring service in the target compartment.

Using Terraform

# Create an active log group for Audit logs
resource "oci_logging_log_group" "AUDIT_LOG_GROUP" {
  # Replace with the OCID of the compartment where you want the log group
  compartment_id = "OCID_OF_TARGET_COMPARTMENT"

  display_name = "audit-log-group"
  description  = "Log group for tenancy audit logs"
}

# Create an enabled log in that group for the Audit service
resource "oci_logging_log" "AUDIT_LOG" {
  log_group_id = oci_logging_log_group.AUDIT_LOG_GROUP.id

  display_name = "tenancy-audit-log"
  description  = "Active log for Audit events"

  # Ensure the log is enabled
  is_enabled = true

  log_type = "SERVICE"

  configuration {
    source {
      # For Audit service logs
      category = "audit"
      service  = "audit"
      # Replace with the OCID of the target resource if you want to scope,
      # or omit `resource` to collect at the compartment/tenancy level
      # resource = "OCID_OF_TARGET_RESOURCE"
    }

    # Optional: configure log retention in days
    # retention_duration = 90
  }

  # Replace with the OCID of the compartment where this log should live
  compartment_id = "OCID_OF_TARGET_COMPARTMENT"
}

Substitute:

OCID_OF_TARGET_COMPARTMENT with the compartment OCID where you want to store the log group/log.
Optionally set resource inside configuration.source if you need to scope logs to a specific resource.

This change does not replace existing resources; it adds a new log group and an enabled log.

For Monitoring service logs instead of Audit, keep the same structure but set:

service = "monitoring"
category to an appropriate Monitoring log category.

Verification: terraform plan should show + (create) for oci_logging_log_group.AUDIT_LOG_GROUP and oci_logging_log.AUDIT_LOG with is_enabled = true.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

1. Sign in and choose the right compartment​

2. Go to Service Logs​

3. Enable Logging service logs​

4. Verify logs are active​

1. Set common variables (optional but recommended)​

2. Create a Log Group (if you don’t have one)​

3. Create an Active Service Log for Monitoring​

4. Verify the Log is Active​

1. Install and Configure the OCI Python SDK​

2. Decide the Target Compartment and Log Group​

3. Python Script: Ensure Log Group Exists and Enable Monitoring Service Log​

4. Notes / Adjustments​