Based on the type of service logs that you want to ingest, you must create policies to enable Oracle Logging Analytics to get the information about the resources and create an entity for each resource.

After you create the policy, the entity that is created will be auto-associated with all the logs collected from that resource. If the policy is not created, then the logs are still ingested but the entity is not created.

The following permissions are for uploading logs to Oracle Logging Analytics from the service connector. You are prompted to add these policy statements when you create the service connector through OCI console. Alternatively, you can manually create the policy that includes the following policy statements:

allow any-user to {LOG_ANALYTICS_LOG_GROUP_UPLOAD_LOGS} in compartment id <Log_Group_Compartment_OCID> where all {request.principal.type = 'serviceconnector', target.loganalytics-log-group.id = '<Log_Group_OCID>', request.principal.compartment.id = '<Service_Connector_Compartment_OCID>'}
allow group <userGroup> to MANAGE serviceconnectors in tenancy
allow group <userGroup> to READ logging-family in tenancy

In the above policy statements,

• Log_Group_Compartment_OCID: The compartment OCID of the log group in Oracle Logging Analytics where the logs must be stored.

• Log_Group_OCID: The OCID of the log group in Oracle Logging Analytics where the logs must be stored.

• Service_Connector_Compartment_OCID: The compartment OCID of the service connector hub.

Oracle Logging Analytics creates an entity representing the underlying OCI resource when new logs are received through the service connector. In order to obtain the necessary information from the OCI resource, you must provide Oracle Logging Analytics with a minimum of read access to the OCI resource. For example, in order to read information about a VNIC, you can write one of the following policies:

Policy statement with the READ PRIVILEGE of the OCI resource:

allow service loganalytics to {VNIC_READ} in compartment <specify_compartment>

OR

Policy statement with the read verb for the OCI RESOURCE:

allow service loganalytics to read vnics in compartment <specify_compartment>

The above policy statements restrict the read access to a compartment. To extend the access to the entire tenancy, you can change the policy statement accordingly.

The following OCI resources are supported in Oracle Logging Analytics for log collection through the service connector. You can either create the policy using read verb for the OCI resource or use the read privilege for the resource as illustrated above.

Before you set up the service connector to ingest logs, ensure that the compartment and log group are identified for the logs that you want to ingest.

In the following example, the steps show you how to collect VCN service logs from Oracle Cloud Infrastructure Logging service:

1. This is a suggestive step to show you how to enable logs in the Oracle Cloud Infrastructure Logging service.

   Go to Oracle Cloud Infrastructure Logging service > Go to Logs.

   Click Enable Resource Log to enable VCN service logs. The dialog box opens.

   1. Select the resource compartment.
   2. Select the service, for example, Virtual Cloud Network (subnets).
   3. Select the resource, for example, the VCN resource.
   4. Under Configure Log, select the log category, for example, Flow Logs, and the log name.
   5. Under Log Location, select the compartment and log group that Oracle Logging Analytics will refer the logs from.

   Click Enable Log.

2. Set up the service connector by specifying the source service of the logs and the target as Oracle Logging Analytics. You can either set it up from the source service that has integrated with Oracle Cloud Infrastructure Service Connector Hub, for example, Oracle Cloud Infrastructure Logging service, or directly from Oracle Cloud Infrastructure Service Connector Hub.

   Go to Oracle Cloud Infrastructure Logging service > Go to Service Connectors > Click Create Connector.

   Alternatively, go to Oracle Cloud Infrastructure Service Connector Hub service > Click Create Service Connector.

   The Create Service Connector page opens.

   1. Enter a name for the connector and provide a description.
   2. Select the resource compartment where the connector resource must be created.
   3. Under Configure Service Connector, specify Logging as the Source service, and Logging Analytics as the Target service.
   4. Under Configure Source Connection, provide the details of the logs to collect from the service, for example, the VCN service logs.

      Select the compartment name, the log group to which the logs belong, and the name of the logs that you had configured in step 1.

   You can configure the same service connector to collect more logs. Click Another Log and repeat step 2-d.

   Optionally, you can create filters under Configure Task.

   Click Create Connector.

After the service connector is created, you can verify that the selected logs are available in Oracle Logging Analytics.

Let Source_Tenant be the tenant of the source service such as Oracle Cloud Infrastructure Logging from which logs are collected. Let Target_Tenant be the tenant in which the service connector is created. The service connector is configured with Oracle Logging Analytics as the target for the logs that are collected from the source service. It is assumed that the service connector hub and Oracle Logging Analytics are available on the same target tenant.

Set the following policies to configure the log collection from a tenancy that is different from the tenancy the service connector is created in.

define tenancy <Target_Tenant> as <Target_Tenant_OCID>
define group <Common_User_Group> as <Common_User_Group_OCID>
admit any-user of tenancy <Target_Tenant> to read logging-family IN TENANCY WHERE ALL {request.principal.type = 'serviceconnector'}
admit group <Common_User_Group> of tenancy <Target_Tenant> to read logging-family IN TENANCY

admit group <Common_User_Group> of tenancy <Target_Tenant> to read audit-events in TENANCY
admit any-user of tenancy <Target_Tenant> to read audit-events IN tenancy WHERE ALL {request.principal.type = 'serviceconnector'}

define tenancy <Source_Tenant> as <Source_Tenant_OCID>
endorse any-user to read logging-family IN tenancy <Source_Tenant> WHERE ALL {request.principal.type = 'serviceconnector'}
endorse group <Common_User_Group> to read logging-family IN tenancy <Source_Tenant>

endorse group <Common_User_Group> to read audit-events in tenancy <Source_Tenant>
endorse any-user to read audit-events in tenancy <Source_Tenant> WHERE ALL {request.principal.type = 'serviceconnector'}

allow any-user to {LOG_ANALYTICS_LOG_GROUP_UPLOAD_LOGS} in compartment id <Log_Group_Compartment_OCID> where all {request.principal.type = 'serviceconnector', target.loganalytics-log-group.id = '<Log_Group_OCID>', request.principal.compartment.id = '<Service_Connector_Compartment_OCID>'}
allow group <Common_User_Group> to MANAGE serviceconnectors in tenancy

oci --profile <Target_Profile> sch service-connector create 
    --display-name XTenancyConnector 
    --compartment-id <Connector_Compartment_OCID> 
    --source '{ "kind": "logging", "logSources": 
        [ { "compartmentId": "<Logging_LogGroup_Compartment_OCID>", 
            "logGroupId": "<Logging_LogGroup_OCID>" } ] }' 
    --target '{ "kind": "loggingAnalytics", "logGroupId": "<LoggingAnalytics_LogGroup_OCID>" }'