Observability and Cost Management

Understanding how to monitor your OCI resources and manage costs is essential for operating a healthy cloud environment. This lesson covers OCI Monitoring, Logging, Audit, and cost management tools.

---

OCI Monitoring

OCI Monitoring collects metrics from your cloud resources and enables alerting:

Metrics

Automatically collected from OCI services:

Service	Example Metrics
Compute	CPU utilisation, memory usage, disk I/O, network bytes
Block Volume	Read/write IOPS, throughput, latency
Object Storage	Request count, bytes transferred
Autonomous DB	CPU utilisation, storage used, SQL executions
Load Balancer	Request count, latency, backend health
Functions	Invocations, duration, errors

Alarms

Define alarms to trigger notifications when metrics exceed thresholds:

• Metric condition — which metric, statistic, threshold, and evaluation period
• Notification — send alerts via email, Slack, PagerDuty, SMS (via ONS)
• Suppression — temporarily suppress alarms during maintenance windows

Example: Alert when Compute CPU utilisation exceeds 90% for 5 consecutive minutes.

Queries (MQL)

Use the Monitoring Query Language (MQL) for custom metric queries:

CpuUtilization[1m]{resourceId = "<instance-ocid>"}.mean()

---

OCI Logging

OCI Logging is a scalable service for ingesting, managing, and analysing log data:

Log Categories

Category	Description	Examples
Audit Logs	API calls to OCI (automatic)	CreateInstance, DeleteBucket
Service Logs	Logs from OCI services	VCN flow logs, LB access logs, Object Storage logs
Custom Logs	Logs from your applications	Application logs via the Logging agent

Log Groups

Organise logs into log groups for access control and management.

Logging Analytics

For advanced log analysis:

• Machine learning — automatic pattern detection and anomaly alerting
• Log Explorer — visual query builder for log analysis
• Correlation — correlate logs across services
• Dashboards — pre-built and custom dashboards

---

OCI Audit

Audit automatically records all API calls made to your tenancy:

What Audit Records

• Who — the user, service, or resource principal
• What — the API operation (e.g., CreateInstance, UpdateSecurityList)
• When — the timestamp
• Where — the source IP address
• Result — success or failure, response status code

Retention

• 365 days of audit data retained automatically
• Export to Object Storage for longer retention

Use Cases

• Security investigation — who modified the security list?
• Compliance — demonstrate that access controls are enforced
• Troubleshooting — what API call caused the failure?

---

Cloud Guard