Based on the type of service logs that you want to ingest, you must create policies to enable Oracle Logging Analytics to get the information about the resources and create an entity for each resource.

After you create the policy, the entity that is created will be auto-associated with all the logs collected from that resource. If the policy is not created, then the logs are still ingested but the entity is not created.

The following permissions are for uploading logs to Oracle Logging Analytics from the service connector. You are prompted to add these policy statements when you create the service connector through OCI console. Alternatively, you can manually create the policy that includes the following policy statements:

allow any-user to {LOG_ANALYTICS_LOG_GROUP_UPLOAD_LOGS} in compartment id <Log_Group_Compartment_OCID> 
    where all 
    {request.principal.type = 'serviceconnector', 
    target.loganalytics-log-group.id = '<Log_Group_OCID>',
    request.principal.compartment.id = '<Service_Connector_Compartment_OCID>'}
allow group <userGroup> to MANAGE serviceconnectors in tenancy
allow group <userGroup> to READ logging-family in tenancy

In the above policy statements,

• Log_Group_Compartment_OCID: The compartment OCID of the log group in Oracle Logging Analytics where the logs must be stored.

• Log_Group_OCID: The OCID of the log group in Oracle Logging Analytics where the logs must be stored.

• Service_Connector_Compartment_OCID: The compartment OCID of the service connector hub.

Policy for each type of service logs:

• API Gateway Logs

  allow service loganalytics to read api-gateway-family in tenancy

• OCI Application Performance Monitoring Logs

  allow service loganalytics to {APM_DOMAIN_READ} in tenancy

• Event Service Logs

  allow service loganalytics to {EVENTRULE_READ} in tenancy

• Function Logs

  allow service loganalytics to read functions-family in tenancy

• Load Balancer Logs

  allow service loganalytics to {LOAD_BALANCER_READ} in tenancy

• Media Flow Logs

  allow service loganalytics to {MEDIA_WORKFLOW_READ} in tenancy

• Network Firewall Logs

  allow service loganalytics to {NETWORK_FIREWALL_READ} in tenancy

• Object Storage Logs

  allow service loganalytics to {BUCKET_READ} in tenancy

• OCI DevOps Logs

  allow service loganalytics to {DEVOPS_DEPLOYMENT_READ} in tenancy
  allow service loganalytics to {DEVOPS_DEPLOY_PIPELINE_READ} in tenancy
  allow service loganalytics to {DEVOPS_DEPLOY_STAGE_READ} in tenancy

• OCI DevOps Build Logs

  allow service loganalytics to {DEVOPS_BUILD_PIPELINE_READ} in tenancy
  allow service loganalytics to {DEVOPS_BUILD_PIPELINE_STAGE_READ} in tenancy
  allow service loganalytics to {DEVOPS_BUILD_RUN_READ} in tenancy

• OCI Email Delivery Logs

  allow service loganalytics to {APPROVED_SENDER_READ} in tenancy

• Oracle Operator Access Control Logs

  allow service loganalytics to read operator-control-family in tenancy

• OCI Site-to-Site VPN Logs (IPSec Connection)

  allow service loganalytics to {IPSEC_CONNECTION_READ} in tenancy

• OCI WAF Logs

  allow service loganalytics to {WEB_APP_FIREWALL_READ} in tenancy

• Virtual Cloud Network Logs

  allow service loganalytics to {VNIC_READ} in tenancy

Before you set up the service connector to ingest logs, ensure that the compartment and log group are identified for the logs that you want to ingest.

In the following example, the steps show you how to collect VCN service logs from Oracle Cloud Infrastructure Logging service:

1. This is a suggestive step to show you how to enable logs in the Oracle Cloud Infrastructure Logging service.

   Go to Oracle Cloud Infrastructure Logging service > Go to Logs.

   Click Enable Resource Log to enable VCN service logs. The dialog box opens.

   1. Select the resource compartment.
   2. Select the service, for example, Virtual Cloud Network (subnets).
   3. Select the resource, for example, the VCN resource.
   4. Under Configure Log, select the log category, for example, Flow Logs, and the log name.
   5. Under Log Location, select the compartment and log group that Oracle Logging Analytics will refer the logs from.

   Click Enable Log.

2. Set up the service connector by specifying the source service of the logs and the target as Oracle Logging Analytics. You can either set it up from the source service that has integrated with Oracle Cloud Infrastructure Service Connector Hub, for example, Oracle Cloud Infrastructure Logging service, or directly from Oracle Cloud Infrastructure Service Connector Hub.

   Go to Oracle Cloud Infrastructure Logging service > Go to Service Connectors > Click Create Connector.

   Alternatively, go to Oracle Cloud Infrastructure Service Connector Hub service > Click Create Service Connector.

   The Create Service Connector page opens.

   1. Enter a name for the connector and provide a description.
   2. Select the resource compartment where the connector resource must be created.
   3. Under Configure Service Connector, specify Logging as the Source service, and Logging Analytics as the Target service.
   4. Under Configure Source Connection, provide the details of the logs to collect from the service, for example, the VCN service logs.

      Select the compartment name, the log group to which the logs belong, and the name of the logs that you had configured in step 1.

   You can configure the same service connector to collect more logs. Click Another Log and repeat step 2-d.

   Optionally, you can create filters under Configure Task.

   Click Create Connector.

After the service connector is created, you can verify that the selected logs are available in Oracle Logging Analytics.

Let Source_Tenant be the tenant of the source service such as Oracle Cloud Infrastructure Logging from which logs are collected. Let Target_Tenant be the tenant in which the service connector is created. The service connector is configured with Oracle Logging Analytics as the target for the logs that are collected from the source service. It is assumed that the service connector hub and Oracle Logging Analytics are available on the same target tenant.

Set the following policies to configure the log collection from a tenancy that is different from the tenancy the service connector is created in.

define tenancy <Target_Tenant> as <Target_Tenant_OCID>
define group <Common_User_Group> as <Common_User_Group_OCID>
admit any-user of tenancy <Target_Tenant> to read logging-family IN TENANCY WHERE ALL {request.principal.type = 'serviceconnector'}
admit group <Common_User_Group> of tenancy <Target_Tenant> to read logging-family IN TENANCY

define tenancy <Source_Tenant> as <Source_Tenant_OCID>
endorse any-user to read logging-family IN tenancy <Source_Tenant> WHERE ALL {request.principal.type = 'serviceconnector'}
endorse group <Common_User_Group> to read logging-family IN tenancy <Source_Tenant>

allow any-user to {LOG_ANALYTICS_LOG_GROUP_UPLOAD_LOGS} in compartment id <Log_Group_Compartment_OCID> 
    where all 
    {request.principal.type = 'serviceconnector', 
    target.loganalytics-log-group.id = '<Log_Group_OCID>',
    request.principal.compartment.id = '<Service_Connector_Compartment_OCID>'}
allow group <Common_User_Group> to MANAGE serviceconnectors in tenancy

oci --profile <Target_Profile> sch service-connector create 
    --display-name XTenancyConnector 
    --compartment-id <Connector_Compartment_OCID> 
    --source '{ "kind": "logging", "logSources": 
        [ { "compartmentId": "<Logging_LogGroup_Compartment_OCID>", 
            "logGroupId": "<Logging_LogGroup_OCID>" } ] }' 
    --target '{ "kind": "loggingAnalytics", "logGroupId": "<LoggingAnalytics_LogGroup_OCID>" }'