Overview

Oracle Cloud Infrastructure (OCI) is an infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) used by enterprise-scale companies. It includes a full suite of over 30 managed services for hosting, storage, networking, databases, and more.

Use Datadog’s OCI integration to get full visibility into your OCI environment through metrics, logs, and resource data. This data enables you to power dashboards, helps with troubleshooting, and can be monitored for security and compliance posture.

Setup

Datadog recommends using the QuickStart setup method described below. If needed, you can also manually set up the integration.

Metric collection

Datadog’s OCI QuickStart is a fully managed, single-flow setup experience that helps you monitor your OCI infrastructure and applications in just a few clicks. OCI QuickStart creates the necessary infrastructure for forwarding metrics, logs, and resource data to Datadog, and automatically discovers new resources or OCI compartments for data collection.

Notes:

• Only metrics are sent by default. Enable log collection and resource data collection from the Datadog OCI integration tile after completing this setup.
• All OCI Commercial regions that existed as of July 15, 2025 are supported. OCI regions added after this date are not currently supported.
• The Datadog OCI integration is restricted to one integration per tenancy. If you had set up the integration prior to June 2025, you followed the manual setup, and any previous Datadog OCI integration deployment stacks must be deleted before using the OCI QuickStart setup method. If you manually configured log forwarding, and choose to enable log collection in the OCI QuickStart tile, you must also delete your log forwarding resources to avoid sending logs twice. See the manual to QuickStart migration section of this page for more information.

To set up the infrastructure for metric and log forwarding to Datadog:

• Configure the Datadog OCI integration tile
• Deploy the QuickStart stack
• Complete the setup in Datadog
• Validate metrics are flowing
• Configure metric collection (optional)
• Configure log collection (optional)
• Configure resource collection (optional)

The integration requires using Oracle Service Connector Hubs to forward data to Datadog. It is recommended that you request a service limit increase before completing the setup. The approximate number of Service Connector Hubs you need is:

$$\text"Service Connector Hubs" = \text"Number of compartments in tenancy" / \text"5"$$

Datadog OCI integration tile

1. Go to the Datadog OCI integration tile and click Add New Tenancy.
2. Select or create a Datadog API key to use for the integration.
3. Create a Datadog application key.
4. Click Create OCI Stack. This takes you to an Oracle Resource Manager (ORM) stack to finish deployment.
   Note: Deploy this stack only once per tenancy.

ORM stack

1. Accept the Oracle Terms of Use.
2. Leave the option to use custom Terraform providers unchecked.
3. Use the default working directory to deploy the stack in, or optionally choose a different one.
4. Click Next.
5. Datadog recommends leaving the (Optional) Choose specific subnet(s) section blank to create a new Virtual Cloud Network (VCN) and subnet in each region in this tenancy.
   Optionally, you can choose existing subnets (maximum of one per OCI region) for the Datadog QuickStart stack, in which case you need to provide the stack with the subnet OCIDs. Enter one OCID per line, without commas. The Datadog QuickStart stack is then deployed in the region corresponding to each subnet. Each subnet OCID should be in the format: ocid1.subnet.oc[0-9].*. For example, ocid1.subnet.oc1.iad.abcedfgh.
6. Datadog recommends leaving the (Optional) Advanced configuration section blank to create a new Compartment, Group, and User. The Group and User are created in the OCI Identity Domain that you are currently logged into (which doesn’t need to be the Default domain).
   Optionally, you can choose an existing Compartment, Group, and User for the Datadog QuickStart stack.
   a. Compartment: Choose an existing compartment to place all the resources created by Datadog.
   b. Group ID: Provide the OCID of an existing OCI Group for Datadog authentication. The group must be in the current Identity Domain. If provided, User ID cannot be left blank.
   c. User ID: Provide the OCID of an existing OCI User for Datadog authentication. The user must belong to the current Identity Domain, and be a member of the specified Group. If provided, Group ID cannot be left blank.
7. Click Next.
8. Click Create, and wait up to 30 minutes for the deployment to complete.

Complete the setup in Datadog

Return to the Datadog OCI integration tile and click Ready!

Validation

View oci.* metrics in the OCI integration overview dashboard or Metrics Explorer page in Datadog.

Configuration

After completing the setup, a configuration tab for the tenancy becomes available on the left side of the Datadog OCI integration tile. Apply tenancy-wide data collection configurations as outlined in the sections below.

Add regions

On the General tab, select the regions for data collection from the Regions checkbox list. Region selections apply to the entire tenancy, for both metrics and logs.

Note: If you used the QuickStart setup method, and afterward subscribed to a new OCI region, reapply the initial setup stack in ORM. The new region then becomes available in the Datadog OCI tile.

Metric and log collection

Use the Metric collection and Log collection tabs to configure which metrics and logs are sent to Datadog:

• Enable or disable collection of metrics or logs for the entire tenancy
• Include or exclude specific compartments based on key:value format compartment tags. For example:
  • datadog:monitored,env:prod* includes compartments if either of these tags is present
  • !env:staging,!testing excludes compartments only if both tags are present
  • datadog:monitored,!region:us-phoenix-1 includes compartments that both have the tag datadog:monitored and do not have the tag region:us-phoenix-1
• Enable or disable collection for specific OCI services

Notes:

• After modifying tags in OCI, it may take up to 15 minutes for the changes to appear in Datadog.
• In OCI, tags are not inherited by child compartments; each compartment must be tagged individually.

Log collection

1. Ensure that you’ve followed the steps in the setup section to create the necessary infrastructure for forwarding both metrics and logs to Datadog.
2. Click the Enable Log Collection toggle on the Log Collection tab of the Datadog OCI integration tile.

Resource Collection

On the Resource Collection tab of the Datadog OCI integration tile, click the Enable Resource Collection toggle. Resources are visible in the Datadog Resource Catalog.

OCI integration manual to QuickStart migration

Why do I need to migrate?

The Datadog OCI integration is restricted to one integration per tenancy. If you had set up the integration prior to June 2025, you followed the manual setup, and any previous Datadog OCI integration deployment stacks must be deleted before using the OCI QuickStart setup method. If you manually configured log forwarding, and choose to enable log collection in the OCI QuickStart tile, you must also delete your log forwarding resources to avoid sending logs twice.

Note: There will be a gap in metrics and log collection from the time the manual integration is deleted to when the QuickStart deployment is complete.

How to migrate

Delete previous integration resources in both Datadog and OCI:

In Datadog

In the Datadog OCI integration tile, click Delete Configuration. At this point, metrics and logs are no longer collected.

In OCI

Complete the following steps for each region in which the manual integration was previously deployed:

1. Run a Destroy job on the Datadog OCI metric forwarding stack, to remove all the resources created by the stack. By default, the stack is labeled as datadog-oci-orm-metrics-setup.zip-<NUMBER>, but could have been configured with a custom value during deployment.
2. Run a Destroy job on the Datadog OCI policy stack. By default, the stack is labeled as datadog-oci-orm-policy-setup.zip-<NUMBER>, but could have been configured with a custom value during deployment.
3. Optionally, delete the Datadog OCI stacks after destruction is complete.
4. If you configured log collection, delete the Datadog OCI application, function, and service connector hub.

You are now ready to deploy OCI QuickStart with the QuickStart setup instructions and resume data collection. OCI QuickStart deployment can take up to 30 minutes to complete.

Architecture

Metric and log forwarding resources

For each region monitored, this setup option creates the following infrastructure within that region to forward metrics and logs to Datadog:

• Function Application (dd-function-app)
• Two functions:
  • Metrics Forwarder (dd-metrics-forwarder)
  • Logs Forwarder (dd-logs-forwarder)
• VCN (dd-vcn) with secure networking infrastructure:
  • Private subnet (dd-vcn-private-subnet)
  • NAT gateway (dd-vcn-natgateway) for external access to the internet
  • Service gateway (dd-vcn-servicegateway) for internal access to OCI services
• Key Management Service (KMS) vault (datadog-vault) to store the Datadog API key
• Dedicated Datadog compartment (Datadog)

All resources are tagged with ownedby = "datadog".

IAM resources

This setup option creates the following IAM resources to enable data forwarding to Datadog:

• Service user (dd-svc)
• Group (dd-svc-admin) that the service user belongs to
• RSA key pair for API authentication
• OCI API key for the service user
• Dynamic Group (dd-dynamic-group-connectorhubs) that includes all service connectors in the Datadog compartment
• Dynamic Group (dd-dynamic-group-function) that includes all functions in the Datadog compartment
• Policy (dd-svc-policy) to give the service user read access to the tenancy resources, as well as access to manage OCI Service Connector Hubs and OCI Functions in the compartment created and managed by Datadog

- Allow dd-svc-admin to read all-resources in tenancy
- Allow dd-svc-admin to manage serviceconnectors in Datadog compartment
- Allow dd-svc-admin to manage functions-family in Datadog compartment with specific permissions:
     * FN_FUNCTION_UPDATE
     * FN_FUNCTION_LIST
     * FN_APP_LIST
- Endorse dd-svc-admin to read objects in tenancy usage-report

• Policy dd-dynamic-group-policy to enable the service connectors to read data (logs and metrics) and interact with functions. This policy also allows the functions to read secrets in the Datadog compartment (the Datadog API and application keys stored in the KMS vault)

   - Allow dd-dynamic-group-connectorhubs to read log-content in tenancy
   - Allow dd-dynamic-group-connectorhubs to read metrics in tenancy
   - Allow dd-dynamic-group-connectorhubs to use fn-function in Datadog compartment
   - Allow dd-dynamic-group-connectorhubs to use fn-invocation in Datadog compartment
   - Allow dd-dynamic-group-functions to read secret-bundles in Datadog compartment

Data Collected

Metrics

For a detailed list of metrics, select the appropriate OCI service in the metric namespace section.

Service Checks

The OCI integration does not include any service checks.

Events

The OCI integration does not include any events.

Troubleshooting

Need help? Contact Datadog support.

Further Reading

Additional helpful documentation, links, and articles:

• Monitor Oracle Cloud Infrastructure with Datadog
• Accelerate Oracle Cloud Infrastructure monitoring with Datadog OCI QuickStart