Managing and Searching Logs with Operator Access Control

To audit the actions that an Oracle operator performs on your system, you can create an audit log for a compartment and a particular service where you want to monitor Oracle operator actions.

1. Log in to your Oracle Cloud Infrastructure tenancy.
2. Open the navigation menu. Under Oracle AI Database, click Operator Access Control.
3. Click Operator Controls.
4. From the list of Operator Controls, click the name of the Operator Control that you want to enable logs.
5. Click the Logs tab.

   You can enable Access Logs and Hypervisor Logs.

   For example, to enable Access Logs, do the following:

   • Click the Actions menu (three dots), and select the Enable log option
   • Compartment: Select the compartment where you want to create the log.
   • Log Group: Select a log group to which you want to add the log. A log group is a logical container for logs that helps streamline log management, such as applying policies or analyzing related logs.

     If you want to create a new log group, the click Create new group, and provide information for the following fields:

     • Compartment Select the compartment where you want to place the log group.
     • Name: Provide a name for the log group.
     • Description: Provide a description for the purpose of the log group.
     • Tags: Optionally, add tags to the log group.
   • Log Name: Provide a name for the log that you want to create.
   • Enable legacy archival logs: Enable this option to retain and manage archival logs.
   • (Optional) Click Show Advanced options. Set the Log retention period. Default: 30 days.
   • When you have completed and reviewed your selections, click Enable Log. The log pertaining to the operator control is enabled.

1. Log in to your Oracle Cloud Infrastructure tenancy.
2. Open the navigation menu. Under Oracle AI Database, click Operator Access Control.
3. Click Operator Controls.
4. From the list of Operator Controls, click the name of the Operator Control that you want to enable logs.
5. Click the Logs tab.

1. Log in to your Oracle Cloud Infrastructure tenancy.
2. Open the navigation menu. Under Oracle AI Database, click Operator Access Control.
3. Click Operator Controls.
4. From the list of Operator Controls, click the name of the Operator Control that you want to enable logs.
5. Click the Logs tab.

   You can disable Access Logs and Hypervisor Logs.

   For example, to disable Access Logs, click the Actions menu (three dots), and select the Disable log option.

1. Log in to your Oracle Cloud Infrastructure tenancy.
2. Open the navigation menu. Under Oracle AI Database, click Operator Access Control.
3. Click Operator Controls.
4. From the list of Operator Controls, click the name of the Operator Control that you want to enable logs.
5. Click the Logs tab.

   You can delete Access Logs and Hypervisor Logs.

   For example, to delete Access Logs, click the Actions menu (three dots), and select the Delete option.

The log is enabled based on specific Operator Controls. Hence these form the top level filter for the log searches. Additionally, you can also search logs for the Access Request IDs, Exadata systems where the operator action occurred, or the time when the action occurred.

The following examples help you understand how to search for specific field.

1. Log in to the Observability & Management console.
2. On the left navigation menu, select Logging, and then select Logs.
3. Choose the compartment where the logs are stored.

   This will provide a list of logs which were enabled.

4. Click the log that you are interested in.

   The log detail page is displayed.

   These logs are always related to a single operator control.

5. Click the Explore log tab.
6. Click Explore with log search to search for specific logs.
7. Case 1: Searching for actions performed using the approval for a specific access request, ocid.opctlaccessrequest.x during a period T-start to T-end pertaining to an Operator Control, ocid.opctl.x.
   1. Choose Custom from the Filter By Time field.
   2. Select Start Date and End Date.
   3. Click Search.

      After choosing you would be able to see a set of logs.

   4. Now, for example, add the following search criteria into the Custom filters field.

      data.accessRequestId='ocid.opctlaccessrequest.x'

      This will list the logs matching the search criteria.

8. Case 2: Searching for actions on an Exadata systems, ocid.exadata.x during a period T-start to T-end pertaining to an Operator Control, ocid.opctl.x.
   1. Choose Custom from the Filter By Time field.
   2. Click Search.

      After choosing you would be able to see a set of logs.

   3. Now, for example, add the following search criteria into the Custom filters field.

      data.systemOcid ='ocid.exadata.x'

      This will list the logs matching the search criteria.

9. You can also search the logs by the content. Use the log-content field. For more information, see Searching Logs.
10. To search for specific Linux commands executed, use the Advanced Mode.
    1. Create a basic search using the examples given above (case 1 or case 2), and then switch to Advanced Mode.
       For example, to search for all the logs with the action vi add the following criteria:

       and text_contains(data.message, 'proctitle=vi ', true)

11. When performing a search on the Logging Search page, you can click Show Advanced Mode to enter your own custom log search queries.
    For example:

    search "ocid1.compartment.oc1..x/ocid1.loggroup.oc1.iad.loggroup_x/ocid1.log.oc1.iad.log_x"
     | data.systemOcid='ocid1.exadata.x' and text_contains(data.message, 'proctitle=vi ', true)
     | sort by datetime desc