16.2 Logging Search, the Logging Query Language & OCI Audit

Logging Search

The Search page in OCI Logging lets you query many logs at once: several logs, several log groups, or a whole compartment, including the _Audit log group. Results can be filtered, aggregated, and visualized. Searches are available in the Console, the Logging Search API, and the CLI.

• Basic mode builds filters with form fields and a time range.
• Advanced mode lets you write the Logging Query Language directly.
• Saved searches store useful queries for reuse by the team.

Field names are case-sensitive and use JSON dot notation, such as data.statusCode. Names with special characters are quoted, such as "opc-request-id".

The Logging Query Language

A query is a pipeline. It starts with a log stream and passes the entries through operators separated by |.

Log Streams

search "compartmentOcid/logGroupNameOrOcid/logNameOrOcid"
search "compartmentOcid/logGroupNameOrOcid"
search "compartmentOcid"
search "compartmentOcid/appLogs/apiLog", "compartmentOcid_2/lbLogs"

The scope can be one log, one log group, or a whole compartment, and several streams can be combined in one query.

Filtering With where

search "compartmentOcid/appLogs"
| where data.statusCode = 500 and data.path = '/checkout'

• Comparison operators: =, !=, >, >=, <, <=; Boolean operators: and, or, and not(...).
• Functions such as contains_ci(...) (case-insensitive) and contains_cs(...) (case-sensitive) check for substrings.
• Full-text search uses the special column logContent, which represents the whole original message. where logContent = 'ERROR' matches a value exactly, and where logContent = '*ERROR*' matches entries that contain ERROR anywhere.

Shaping Results

Aggregate functions include count(), sum(), avg(), min(), max(), first(), and last(). The rounddown(datetime, '1m') function buckets timestamps into intervals in days, hours, minutes, or seconds, which is how you build an "errors per 5 minutes" chart.

Worked Example: Finding a Spike of Errors

search "compartmentOcid/prodLogs/apiGatewayAccess"
| where data.statusCode >= 500
| summarize count() as errors by data.path, rounddown(datetime, '5m') as bucket
| sort by errors desc

This shows which API paths produced server errors in each five-minute bucket, sorted by count. The same search and where logic is what a Connector Hub log filter task uses to choose which entries to move (Section 16.3).

OCI Audit

The Audit service automatically records calls to all public OCI API endpoints, whether they come from the Console, CLI, SDKs, your own clients, or other OCI services. All services support Audit logging, and it needs no setup.

What an Audit Event Contains

Audit events use the CloudEvents 0.1 envelope. Important attributes include:

Since October 8, 2019, Audit uses the version 2 schema, which is what the Console displays.

The Object Storage Limitation

For Object Storage, Audit records bucket-related events, such as creating a bucket or changing its visibility, but not object-related events such as reading or writing objects. Use the Object Storage read and write service logs for object access (Section 16.1).

Viewing and Searching

Audit logs are organized by compartment, so you need to know the compartment where an event happened. You can browse them on the Audit page or search them with other logs through the _Audit log group on the Logging Search page:

search "compartmentOcid/_Audit"
| where data.request.action = 'DELETE'
| sort by datetime desc

IAM and Retention

• Grant auditors read access with a policy such as allow group Auditors to read audit-events in tenancy, or limit it to one compartment.
• Audit logs are retained for 365 days. Retention is a tenancy-level setting that applies to all regions and compartments, and it cannot be changed.
• For longer retention or analysis in other tools, use Connector Hub with Logging as the source and Object Storage, Streaming, or Logging Analytics as the target.

Common Investigation Patterns