--- title: Oracle Cloud Infrastructure description: >- OCI is a collection of cloud services designed to support a range of applications in a hosted environment. breadcrumbs: Docs > Integrations > Oracle Cloud Infrastructure --- # Oracle Cloud Infrastructure Integration version1.1.0 {% callout %} # Important note for users on the following Datadog sites: app.ddog-gov.com {% alert level="warning" %} The Oracle Cloud Infrastructure integration is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site) (). {% /alert %} {% /callout %} ## Overview{% #overview %} Oracle Cloud Infrastructure (OCI) is an infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) used by enterprise-scale companies. It includes a full suite of over 30 managed services for hosting, storage, networking, databases, and more. Use Datadog's OCI integration to get full visibility into your OCI environment through metrics, logs, and resource data. This data enables you to power dashboards, helps with troubleshooting, and can be monitored for security and compliance posture. ## Setup{% #setup %} Datadog recommends using the QuickStart setup method. If needed, you can also manually set up the integration. ### Data collection{% #data-collection %} #### Considerations{% #considerations %} - Logs, metrics, and resource data collection are enabled by default. You can opt out of log collection during setup. After completing the setup, you can modify resource data collection and individual log or metric services from the [Datadog OCI integration tile](https://app.datadoghq.com/integrations/oracle-cloud-infrastructure). - All OCI Commercial regions (in the OC1 realm) that existed as of January 1, 2026 are supported. OCI regions added after this date are not supported. - The Datadog OCI integration is restricted to one integration per tenancy. If you set up the integration prior to June 2025, you followed the manual setup; any resulting Datadog OCI integration deployment stacks must be deleted before using the OCI QuickStart setup method. If you manually configured log forwarding, and choose to enable log collection in the OCI QuickStart tile, you must also delete your existing log forwarding resources to avoid sending logs twice. See the manual to QuickStart migration section of this page for more information. {% collapsible-section %} #### QuickStart (recommended) Datadog's OCI QuickStart is a fully managed, single-flow setup experience that helps you monitor your OCI infrastructure and applications in just a few clicks. OCI QuickStart creates the necessary infrastructure for forwarding metrics, logs, and resource data to Datadog, and automatically discovers new resources or OCI compartments for data collection. #### Choose QuickStart setup if…{% #choose-quickstart-setup-if %} - You are setting up the OCI integration for the first time. - You prefer a UI-based workflow, and want to minimize the time it takes to create and configure the necessary resources. - You want to automate setup steps in scripts or CI/CD pipelines. #### QuickStart setup prerequisites{% #quickstart-setup-prerequisites %} - Your OCI user account needs the **Identity Domain Administrator** role to complete these steps. - You must be logged into OCI in the tenancy you want to integrate with. - You must be logged into OCI with the Home Region selected in the top right of the screen. - Your OCI user account must be able to create a user, user group, and dynamic group in the Identity Domain that you are logged into, or in the target domain if specified. If providing a target domain OCID, your OCI user account must have administrator privileges in that domain. - Your OCI user account must be able to create policies in the root compartment. #### QuickStart setup instructions{% #quickstart-setup-instructions %} To set up the infrastructure for metric and log forwarding to Datadog: - Configure the Datadog OCI integration tile - Deploy the QuickStart ORM stack - Complete the setup in Datadog - Validate metrics are flowing - Configure metric or log collection (optional) - Configure resource collection (optional) The integration requires using Oracle Service Connector Hubs to forward data to Datadog. It is recommended that you [request a service limit increase](https://docs.oracle.com/iaas/Content/General/Concepts/servicelimits.htm#Requesti) before completing the setup. The approximate number of Service Connector Hubs you need is: $$\text"Service Connector Hubs" = \text"Number of compartments in tenancy" / \text"5"$$ ##### Configure the Datadog OCI integration tile{% #configure-the-datadog-oci-integration-tile %} 1. Go to the [Datadog OCI integration tile](https://app.datadoghq.com/integrations/oracle-cloud-infrastructure) and click **Add New Tenancy**. 1. Select or create a Datadog API key to use for the integration. 1. Create a Datadog application key. 1. Enable or disable logs using the toggle. 1. Click **Create OCI Stack**. This takes you to an Oracle Resource Manager (ORM) stack to finish deployment.**Note**: Deploy this stack only once per tenancy. ##### Deploy the QuickStart ORM stack{% #deploy-the-quickstart-orm-stack %} 1. Accept the Oracle Terms of Use. 1. Leave the option to use custom Terraform providers unchecked. 1. Use the default working directory to deploy the stack in, or optionally choose a different one. 1. Click **Next**. 1. Datadog recommends leaving the `(Optional) Choose specific subnet(s)` section blank to create a new Virtual Cloud Network (VCN) and subnet in each region in this tenancy. **Optionally**, you can choose existing subnets (maximum of one per OCI region) for the Datadog QuickStart stack, in which case you need to provide the stack with the subnet OCIDs. Enter one OCID per line, without commas. The Datadog QuickStart stack is then deployed in the region corresponding to each subnet. Each subnet OCID should be in the format: `ocid1.subnet.oc[0-9].*`. For example, `ocid1.subnet.oc1.iad.abcedfgh`.**Note**: If using existing VCN and subnets, ensure that the VCN in each region: - Is allowed to make HTTP egress calls through NAT Gateway. - Has a Service Gateway that supports "All Services In Oracle Services Network". - Has the route table rules to allow NAT Gateway and Service Gateway. - Has the security rules to send HTTP requests. 1. Datadog recommends leaving the `(Optional) Choose a User` section blank to create a new User and Group. The Group and User are created in the OCI Identity Domain that you are currently logged into (which doesn't need to be the Default domain).**Optionally**, you can choose an existing User and Group for the Datadog QuickStart stack. In this case, Datadog automatically infers the user and group's domain, and uses that for creating dynamic groups.a. **Group ID**: Provide the OCID of an existing OCI Group for Datadog authentication. If provided, **User ID** cannot be left blank.b. **User ID**: Provide the OCID of an existing OCI User for Datadog authentication. The user must be a member of the specified Group. If provided, **Group ID** cannot be left blank. 1. Datadog recommends leaving the `(Optional) Advanced configuration` section blank as these use cases are uncommon.**Optionally**, you can choose an existing Compartment and Domain for the Datadog QuickStart stack.a. **Compartment**: Choose an existing Compartment to place all the resources created by Datadog.b. **Domain**: Provide the OCID of an existing Identity Domain to override where the User and Group are created. This field is only shown if an existing User and Group are not specified in step 6. If provided, **User Email** cannot be left blank. **Note**: Your OCI user account must have **Identity Domain Administrator** role in the target domain.c. **Resource tags**: Provide a list of defined tags to be added to all OCI resources deployed by the Datadog QuickStart stack. Enter one tag per line. Do not add commas. Each defined tag should be in the format: `namespace.key:value`. For example, `CostCenter.Environment:prod`. If left blank, no defined tags are added to the OCI resources deployed by the Datadog QuickStart stack. 1. Click **Next**. 1. Click **Create**, and wait up to 30 minutes for the deployment to complete. ##### Complete the setup in Datadog{% #complete-the-setup-in-datadog %} Return to the [Datadog OCI integration tile](https://app.datadoghq.com/integrations/oracle-cloud-infrastructure) and click **Ready!** {% /collapsible-section %} {% collapsible-section %} #### Terraform #### Choose Terraform setup if…{% #choose-terraform-setup-if %} - You manage infrastructure as code and want to keep the Datadog OCI integration under version control. - You need to configure multiple folders or projects consistently with reusable provider blocks. - You want a repeatable, auditable deployment process that fits into your Terraform-managed environment. You can use Terraform to provision the Datadog OCI integration. This guide lists prerequisites, required variables, and the exact steps to initialize, plan, and apply. #### Terraform setup prerequisites{% #terraform-setup-prerequisites %} Have the following before you begin: - Terraform 1.x installed. - A valid [Datadog API key](https://app.datadoghq.com/organization-settings/api-keys). - OCI access with the Identity Domain Administrator role on the target domain. #### Terraform setup instructions{% #terraform-setup-instructions %} To set up the infrastructure for metric and log forwarding to Datadog: - Create an OCI configuration file - Configure the Terraform module - Deploy with Terraform - Validate metrics are flowing - Configure metric or log collection (optional) - Configure resource collection (optional) ##### Create an OCI configuration file{% #create-an-oci-configuration-file %} The `~/.oci/config` file grants Terraform permissions to create resources in OCI. [Create an API key](https://cloud.oracle.com/identity/domains/my-profile/auth-tokens) and add it to your config, or follow the [Oracle docs](https://docs.oracle.com/en-us/iaas/Content/API/Concepts/sdkconfig.htm). Your file should resemble: ```ini [DEFAULT] user= fingerprint= tenancy= region= key_file= ``` ##### Configure the Terraform module{% #configure-the-terraform-module %} The following inputs configure the Datadog OCI integration module. Required fields are noted. For the full list of available configuration options, see the [add tenancy page](https://app.datadoghq.com/integrations/oracle-cloud-infrastructure/add). ###### 1. Add a Datadog API key. Click **Select API Key** and select an API key to use. ###### 2. Create a Datadog application key. Click **Create**, and an application key is generated and added to the field. Ensure to copy this value and save it in a secure location, as it cannot be accessed again after leaving this screen. ###### 3. Add your OCI Tenancy OCID. 1. Enter the OCID of the tenancy to be monitored by Datadog. Find it at [cloud.oracle.com/tenancy](https://cloud.oracle.com/tenancy). 1. Optionally, choose a specific OCI compartment and subnets. Datadog recommends leaving this section blank to create a new OCI compartment and OCI Virtual Cloud Network (VCN) in each region of the tenancy. ###### 4. Add your OCI User OCID. Enter your User OCID. This user must have the Identity Domain Administrator role. Find it at [cloud.oracle.com/identity/domains/my-profile](https://cloud.oracle.com/identity/domains/my-profile). ###### 5. Configure log collection (optional). To disable all log collection from the tenancy, click the toggle. If you want to disable log collection for specific OCI services, edit the configuration after setup. ###### 6. Confirm the configuration details of the generated Terraform module. The generated Terraform module should follow the format shown below: ```hcl module "datadog_oci" { source = "github.com/DataDog/oracle-cloud-integration//datadog-terraform-onboarding" datadog_api_key = datadog_app_key = datadog_site = tenancy_ocid = "" current_user_ocid = "" logs_enabled = true } ``` #### Deploy with Terraform{% #deploy-with-terraform %} 1. Copy the generated Terraform module and paste it into a `.tf` file. 1. Run `terraform init && terraform apply` to initialize Terraform and create the integration. If you want to preview the changes, substitute `plan` for `apply`. #### Troubleshooting{% #troubleshooting %} ##### Timeouts{% #timeouts %} Re-run the Terraform command without changing the configuration. ##### Provider conflicts{% #provider-conflicts %} If you encounter provider conflicts from the `terraform init` command, update your local provider configuration to match the module's required versions. ##### Warnings in Datadog immediately after setup{% #warnings-in-datadog-immediately-after-setup %} Allow up to 15 minutes for warnings to clear. {% /collapsible-section %} #### Validation{% #validation %} View `oci.*` metrics in the [OCI integration overview dashboard](https://app.datadoghq.com/dash/integration/31417/oracle-cloud-infrastructure-oci-overview) or [Metrics Explorer page](https://app.datadoghq.com/metric/explorer) in Datadog. {% alert level="warning" %} OCI function metrics (`oci.faas` namespace) and container instance metrics (`oci_computecontainerinstance` namespace) are in Preview. {% /alert %} ### Configuration{% #configuration %} After completing the setup, a configuration tab for the tenancy becomes available on the left side of the [Datadog OCI integration tile](https://app.datadoghq.com/integrations/oracle-cloud-infrastructure). Apply tenancy-wide data collection configurations as outlined in the sections below. #### Add regions{% #add-regions %} On the **General** tab, select the regions for data collection from the **Regions** checkbox list. Region selections apply to the entire tenancy, for both metrics and logs. **Note**: If you used the QuickStart setup method, and afterward subscribed to a new OCI region, reapply the initial setup stack in ORM. The new region then becomes available in the Datadog OCI tile. #### Metric and log collection{% #metric-and-log-collection %} Use the **Metric collection** and **Log collection** tabs to configure which metrics and logs are sent to Datadog: ##### Enable or disable all metric or log collection from a tenancy{% #enable-or-disable-all-metric-or-log-collection-from-a-tenancy %} Both the metric and log collection tabs have a main toggle you can use to disable collection of that data type for the entire tenancy. If you do collect a given data type for the tenancy, you can use the sections below to implement granular filtering by service, compartment, and specific resources. **Note**: Filters are evaluated in order: **Selected Services** acts as the primary toggle for data collection from a service, then compartment tag filters are applied, and finally resource tag filters. ##### Limit metric or log collection to specific OCI services{% #limit-metric-or-log-collection-to-specific-oci-services %} Use the **Selected Services** section to enable or disable collection from individual OCI services. Disabling a service stops all collection from it, regardless of any resource tag filters configured for it. When a service is enabled, resource tag filters can further narrow collection to specific resources within that service — resources without a matching inclusion tag are excluded. **Note**: After modifying tags in OCI, it may take up to 15 minutes for the changes to appear in Datadog. Service toggle changes may take up to 5 minutes to take effect. {% collapsible-section #tag-filter-syntax %} ###### Tag filter syntax Both the **Compartment Tags** and **Limit Collection to Specific Resources** sections accept comma-separated `key:value` OCI tags. Prefix a tag with `!` to negate it. The comma separator behaves differently depending on the tag types used: - **Positive tags only**: OR logic—included if the OCI object (compartment or specific resource) has **any** of the listed tags. - **Negative tags only** (prefixed with `!`): OR logic—excluded if **any** of the negated tags is present. - **Mixed positive and negative tags**: AND logic—must satisfy **all** listed conditions to be included. For example: - `datadog:monitored,env:prod*`: include if **either** tag is present. - `!env:staging,!testing:true`: exclude if **either** tag is present. - `datadog:monitored,!region:us-phoenix-1`: include only if the `datadog:monitored` tag is present **and** the `region:us-phoenix-1` tag is absent. {% /collapsible-section %} ##### Limit metric or log collection by compartment{% #limit-metric-or-log-collection-by-compartment %} Use the **Compartment Tags** section to include or exclude specific compartments based on OCI compartment tags. See Tag filter syntax for syntax reference. **Note**: In OCI, tags are not inherited by child compartments; each compartment must be tagged individually. ##### Limit metric or log collection to specific resources{% #limit-metric-or-log-collection-to-specific-resources %} Use the **Limit Collection to Specific Resources** section to define which resources should send their metrics or logs to Datadog. Select the OCI service from the dropdown, and then specify which resource tags should be targeted for data collection. See Tag filter syntax for syntax reference. {% collapsible-section #oci-metric-namespaces %} #### See the full list of metric namespaces | Integration | Metric Namespace | | ------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [API Gateway](https://docs.datadoghq.com/integrations/oci_api_gateway/) | [oci_apigateway](https://docs.oracle.com/iaas/Content/APIGateway/Reference/apigatewaymetrics.htm) | | [Autonomous Database](https://docs.datadoghq.com/integrations/oci_autonomous_database/) | [oci_autonomous_database](https://docs.oracle.com/iaas/autonomous-database-serverless/doc/autonomous-monitor-metrics-list.html) | | [Block Storage](https://docs.datadoghq.com/integrations/oci_block_storage/) | [oci_blockstore](https://docs.oracle.com/iaas/Content/Block/References/volumemetrics.htm) | | [Compute](https://docs.datadoghq.com/integrations/oci_compute/) | [oci_computeagent](https://docs.oracle.com/iaas/Content/Compute/References/computemetrics.htm#Availabl), [rdma_infrastructure_health](https://docs.oracle.com/iaas/Content/Compute/References/computemetrics.htm#computemetrics_topic-Available_Metrics_oci_compute_rdma_network), [gpu_infrastructure_health](https://docs.oracle.com/iaas/Content/Compute/References/computemetrics.htm#computemetrics_topic-Available_Metrics_oci_high_performance_compute), [oci_compute_infrastructure_health](https://docs.oracle.com/iaas/Content/Compute/References/infrastructurehealthmetrics.htm) | | [Container Instances (Preview)](https://docs.datadoghq.com/integrations/oci_container_instances/) | [oci_computecontainerinstance](https://docs.oracle.com/iaas/Content/container-instances/container-instance-metrics.htm) | | [Database](https://docs.datadoghq.com/integrations/oci_database/) | [oci_database](https://docs.oracle.com/iaas/base-database/doc/available-metrics-base-database-service-resources.html#DBSCB-GUID-57B7B9B1-288B-4DCB-82AE-D53B2BD9C78F), [oci_database_cluster](https://docs.oracle.com/iaas/base-database/doc/available-metrics-base-database-service-resources.html#DBSCB-GUID-A42CF0E3-EE65-4A66-B8A3-C89B62AFE489) | | [Dynamic Routing Gateway](https://docs.datadoghq.com/integrations/oci-dynamic-routing-gateway/) | [oci_dynamic_routing_gateway](https://docs.oracle.com/iaas/Content/Network/Reference/drgmetrics.htm) | | [E-Business Suite (EBS)](https://docs.datadoghq.com/integrations/oci_ebs/) | [oracle_appmgmt](https://docs.oracle.com/en-us/iaas/stack-monitoring/doc/metric-reference.html) | | [FastConnect](https://docs.datadoghq.com/integrations/oci_fastconnect/) | [oci_fastconnect](https://docs.oracle.com/iaas/Content/Network/Reference/fastconnectmetrics.htm) | | [File Storage](https://docs.datadoghq.com/integrations/oci_file_storage/) | [oci_filestorage](https://docs.oracle.com/iaas/Content/File/Reference/filemetrics.htm) | | [Functions (Preview)](https://docs.datadoghq.com/integrations/oci_functions/) | [oci_faas](https://docs.oracle.com/iaas/Content/Functions/Reference/functionsmetrics.htm) | | [GoldenGate](https://docs.datadoghq.com/integrations/oci-goldengate/) | [oci_goldengate](https://docs.oracle.com/en/cloud/paas/goldengate-service/ofroo/) | | [GPU](https://docs.datadoghq.com/integrations/oci_gpu/) | [gpu_infrastructure_health](https://docs.oracle.com/iaas/Content/Compute/References/computemetrics.htm#computemetrics_topic-Available_Metrics_oci_high_performance_compute) | | [HeatWave MySQL](https://docs.datadoghq.com/integrations/oci_mysql_database/) | [oci_mysql_database](https://docs.oracle.com/iaas/mysql-database/doc/metrics.html) | | [Instance Pools](https://docs.datadoghq.com/integrations/oci-instancepools/) | [oci_instancepools](https://docs.oracle.com/en-us/iaas/Content/Compute/References/instancepoolmetrics.htm) | | [Internet Gateway](https://docs.datadoghq.com/integrations/oci-internet-gateway/) | [oci_internet_gateway](https://docs.oracle.com/en-us/iaas/Content/Network/Reference/IGWmetrics.htm) | | [Kafka](https://docs.datadoghq.com/integrations/oci-kafka/) | [oci_kafka](https://docs.oracle.com/en-us/iaas/Content/kafka/metrics.htm) | | [Kubernetes Engine](https://docs.datadoghq.com/integrations/oke/) | [oci_oke](https://docs.oracle.com/iaas/Content/ContEng/Reference/contengmetrics.htm) | | [Load Balancer](https://docs.datadoghq.com/integrations/oci_load_balancer/) | [oci_lbaas](https://docs.oracle.com/iaas/Content/Balance/Reference/loadbalancermetrics.htm), [oci_nlb](https://docs.oracle.com/iaas/Content/NetworkLoadBalancer/Metrics/metrics.htm) | | [Media Streams](https://docs.datadoghq.com/integrations/oci_media_streams/) | [oci_mediastreams](https://docs.oracle.com/iaas/Content/dms-mediastream/mediastreams_metrics.htm?) | | [NAT Gateway](https://docs.datadoghq.com/integrations/oci_nat_gateway/) | [oci_nat_gateway](https://docs.oracle.com/iaas/Content/Network/Reference/nat-gateway-metrics.htm) | | [Network Firewall](https://docs.datadoghq.com/integrations/oci_network_firewall/) | [oci_network_firewall](https://docs.oracle.com/iaas/Content/network-firewall/metrics.htm) | | [Object Storage](https://docs.datadoghq.com/integrations/oci_object_storage/) | [oci_objectstorage](https://docs.oracle.com/iaas/Content/Object/Reference/objectstoragemetrics.htm) | | [Oracle Integration (OIC)](https://docs.datadoghq.com/integrations/oci-integration/) | [oci_integration](https://docs.oracle.com/en-us/iaas/application-integration/doc/modify-charts-and-create-custom-charts.html) | | [PostgreSQL](https://docs.datadoghq.com/integrations/oci_postgresql/) | [oci_postgresql](https://docs.oracle.com/iaas/Content/postgresql/metrics.htm) | | [Queue](https://docs.datadoghq.com/integrations/oci_queue/) | [oci_queue](https://docs.oracle.com/iaas/Content/queue/metrics.htm) | | [Recovery Service](https://docs.datadoghq.com/integrations/oci-recovery-service/) | [oci_recovery_service](https://docs.oracle.com/iaas/recovery-service/doc/available-recovery-service-metrics.html) | | [Secrets](https://docs.datadoghq.com/integrations/oci-secrets/) | [oci_secrets](https://docs.oracle.com/iaas/Content/KeyManagement/Reference/keymgmtmetrics.htm) | | [Service Connector Hub](https://docs.datadoghq.com/integrations/oci_service_connector_hub/) | [oci_service_connector_hub](https://docs.oracle.com/iaas/Content/connector-hub/metrics-reference.htm) | | [Service Gateway](https://docs.datadoghq.com/integrations/oci_service_gateway/) | [oci_service_gateway](https://docs.oracle.com/iaas/Content/Network/Reference/SGWmetrics.htm) | | [Stack Monitoring](https://docs.datadoghq.com/integrations/oci-stack-monitoring/) | [oci_stack_monitoring](https://docs.oracle.com/en-us/iaas/stack-monitoring/doc/metric-reference.html) | | [VCN](https://docs.datadoghq.com/integrations/oci_vcn/) | [oci_vcn](https://docs.oracle.com/iaas/Content/Network/Reference/vnicmetrics.htm) | | [VPN](https://docs.datadoghq.com/integrations/oci_vpn/) | [oci_vpn](https://docs.oracle.com/iaas/Content/Network/Reference/ipsecmetrics.htm) | | [Web Application Firewall](https://docs.datadoghq.com/integrations/oci_waf/) | [oci_waf](https://docs.oracle.com/iaas/Content/WAF/Reference/metricsalarms.htm) | {% /collapsible-section %} ### Resource Collection{% #resource-collection %} On the **Resource Collection** tab of the [Datadog OCI integration tile](https://app.datadoghq.com/integrations/oracle-cloud-infrastructure), click the **Enable Resource Collection** toggle. Resources are visible in the [Datadog Resource Catalog](https://docs.datadoghq.com/infrastructure/resource_catalog/). ## Uninstalling the integration{% #uninstalling-the-integration %} To uninstall the Datadog OCI integration, delete the integration resources in both Datadog and OCI: ### In Datadog{% #in-datadog %} In the [Datadog OCI integration tile](https://app.datadoghq.com/integrations/oracle-cloud-infrastructure), click **Delete Configuration**. At this point, metrics and logs are no longer collected. ### In OCI{% #in-oci %} If you used the QuickStart setup method: 1. Navigate to the Oracle Resource Manager (ORM) in the OCI console. 1. Locate the Datadog QuickStart stack that was created during installation. By default, the stack is labeled as `datadog-integration.zip-`, but could have been configured with a custom name during deployment. 1. Run a `Destroy` job on the stack to remove all resources created by the integration across all regions. 1. **Optionally**, delete the Datadog OCI stack after destruction is complete. **Note**: Running the destroy job once on the QuickStart stack automatically cleans up all resources in all regions where the integration was deployed. ## OCI integration manual to QuickStart migration{% #oci-integration-manual-to-quickstart-migration %} ### Why do I need to migrate?{% #why-do-i-need-to-migrate %} The Datadog OCI integration is restricted to one integration per tenancy. If you had set up the integration prior to June 2025, you followed the manual setup, and any previous Datadog OCI integration deployment stacks must be deleted before using the OCI QuickStart setup method. If you manually configured log forwarding, and choose to enable log collection in the OCI QuickStart tile, you must also delete your log forwarding resources to avoid sending logs twice. **Note**: There will be a gap in metrics and log collection from the time the manual integration is deleted to when the QuickStart deployment is complete. ### How to migrate{% #how-to-migrate %} Delete previous integration resources in both Datadog and OCI: #### In Datadog{% #in-datadog-1 %} In the [Datadog OCI integration tile](https://app.datadoghq.com/integrations/oracle-cloud-infrastructure), click **Delete Configuration**. At this point, metrics and logs are no longer collected. #### In OCI{% #in-oci-1 %} Complete the following steps for **each region** in which the manual integration was previously deployed: 1. Run a `Destroy` job on the Datadog OCI metric forwarding stack, to remove all the resources created by the stack. By default, the stack is labeled as `datadog-oci-orm-metrics-setup.zip-`, but could have been configured with a custom value during deployment. 1. Run a `Destroy` job on the Datadog OCI policy stack. By default, the stack is labeled as `datadog-oci-orm-policy-setup.zip-`, but could have been configured with a custom value during deployment. 1. **Optionally**, delete the Datadog OCI stacks after destruction is complete. 1. If you configured log collection, delete the Datadog OCI application, function, and service connector hub. You are now ready to deploy OCI QuickStart with the QuickStart setup instructions and resume data collection. OCI QuickStart deployment can take up to 30 minutes to complete. ## Architecture{% #architecture %} ### Metric and log forwarding resources{% #metric-and-log-forwarding-resources %} For each region monitored, this setup option creates the following infrastructure within that region to forward metrics and logs to Datadog: - Function Application (`dd-function-app`) - Two functions: - Metrics Forwarder (`dd-metrics-forwarder`) - Logs Forwarder (`dd-logs-forwarder`) - VCN (`dd-vcn`) with secure networking infrastructure: - Private subnet (`dd-vcn-private-subnet`) - NAT Gateway (`dd-vcn-natgateway`) for external access to the internet - Service Gateway (`dd-vcn-servicegateway`) for internal access to OCI services - Key Management Service (KMS) vault (`datadog-vault`) to store the Datadog API key - Dedicated **Datadog** compartment (`Datadog`) All resources are tagged with `ownedby = "datadog"`. ### IAM resources{% #iam-resources %} This setup option creates the following IAM resources to enable data forwarding to Datadog: - Service user (`dd-svc`). - Group (`dd-svc-admin`) that the service user belongs to. - RSA key pair for API authentication. - OCI API key for the service user. - Dynamic Group (`dd-dynamic-group-connectorhubs`) that includes all service connectors in the Datadog compartment. - Dynamic Group (`dd-dynamic-group-function`) that includes all functions in the Datadog compartment. - Policy (`dd-svc-policy`) to give the service user read access to the tenancy resources, as well as access to manage OCI Service Connector Hubs and OCI Functions in the compartment created and managed by Datadog. {% collapsible-section %} ###### See the policy ```text - Allow dd-svc-admin to read all-resources in tenancy - Allow dd-svc-admin to manage serviceconnectors in Datadog compartment - Allow dd-svc-admin to manage functions-family in Datadog compartment with specific permissions: * FN_FUNCTION_UPDATE * FN_FUNCTION_LIST * FN_APP_LIST - Endorse dd-svc-admin to read objects in tenancy usage-report ``` {% /collapsible-section %} - Policy `dd-dynamic-group-policy` to enable the service connectors to read data (logs and metrics) and interact with functions. This policy also allows the functions to read secrets in the Datadog compartment (the Datadog API and application keys stored in the KMS vault). {% collapsible-section %} ###### See the policy ```text - Allow dd-dynamic-group-connectorhubs to read log-content in tenancy - Allow dd-dynamic-group-connectorhubs to read metrics in tenancy - Allow dd-dynamic-group-connectorhubs to use fn-function in Datadog compartment - Allow dd-dynamic-group-connectorhubs to use fn-invocation in Datadog compartment - Allow dd-dynamic-group-functions to read secret-bundles in Datadog compartment ``` {% /collapsible-section %} {% collapsible-section #oci-manual-setup %} #### Manual setup ### Choose manual setup if…{% #choose-manual-setup-if %} - You need to set up access manually for a small number of tenancies. - You want more step-by-step control over assigning permissions and credentials within the OCI UI. ### Manual setup prerequisites{% #manual-setup-prerequisites %} - Your OCI user account needs the **Identity Domain Administrator** role to complete these steps. - Your tenancy OCID. - A valid [Datadog API key](https://app.datadoghq.com/organization-settings/api-keys). - Username and auth token for a user with the `REPOSITORY_READ` and `REPOSITORY_UPDATE` permissions to pull and push images to a Docker repo. - See [Getting an Auth Token](https://docs.oracle.com/iaas/Content/Registry/Tasks/registrygettingauthtoken.htm) to find out how to create an auth token. - See [Policies to Control Repository Access](https://docs.oracle.com/iaas/Content/Registry/Concepts/registrypolicyrepoaccess.htm#Policies_to_Control_Repository_Access) for more information on the required policies. **Note**: To verify the Docker registry login is correct, see [Logging in to Oracle Cloud Infrastructure Registry](https://docs.oracle.com/iaas/Content/Functions/Tasks/functionslogintoocir.htm). ### Manual setup instructions{% #manual-setup-instructions %} To manually forward your OCI metrics to Datadog: - Enter tenancy info - Deploy OCI policy stack in the home region of your tenancy to create a Datadog read-only user, group, and policies - Enter DatadogROAuthUser info in Datadog - Deploy OCI metric forwarding stack for every tenancy region you want to forward metrics from - Complete the setup in Datadog - Validate metrics are flowing - Configure metric or log collection (optional) For a visual representation of this architecture, see the Architecture section. #### Enter tenancy info{% #enter-tenancy-info %} Enter the OCID and home region of the tenancy you want to monitor in the [Datadog OCI integration tile](https://app.datadoghq.com/integrations/oracle-cloud-infrastructure). - You can find this information on the [Tenancy details page](https://cloud.oracle.com/tenancy). - Enter the home region using the **Region Identifier** value from the OCI [Regions and Availability Domains page](https://docs.oracle.com/iaas/Content/General/Concepts/regions.htm). #### Create OCI policy stack{% #create-oci-policy-stack %} {% alert level="warning" %} Ensure that the **home region** of the tenancy is selected in the top right of the screen. {% /alert %} This Oracle Resource Manager (ORM) policy stack should only be deployed once per tenancy. 1. Click the **Create Policy Stack** button on the Datadog OCI integration tile. 1. Accept the Oracle Terms of Use. 1. Leave the option to use custom Terraform providers **unchecked**. 1. Use the default name and compartment for the stack, or optionally provide your own descriptive name or compartment. 1. Click **Next**. 1. Leave the tenancy field and current user field as-is. 1. Click **Next**. 1. Click **Create**. #### Enter DatadogROAuthUser info{% #enter-datadogroauthuser-info %} 1. In the OCI console search bar, search for `DatadogROAuthUser` and click on the User resource that appears. 1. Copy the user's OCID value. 1. Paste the value into the **User OCID** field in the [Datadog OCI integration tile](https://app.datadoghq.com/integrations/oracle-cloud-infrastructure). 1. Returning to the OCI console, generate an API key with these steps:a. In the bottom left corner of the screen, under **Resources**, click **API keys**.b. Click **Add API key**.c. Click **Download private key**.d. Click **Add**.e. A **Configuration file preview** popup appears, but no action is needed; close the popup. Copy the fingerprint value, and paste it into the **Fingerprint** field on the [Datadog OCI integration tile](https://app.datadoghq.com/integrations/oracle-cloud-infrastructure).Copy the private key value with these steps: a. Open the downloaded private key `.pem` file in a text editor, or use a terminal command such as `cat` to display the file's contents. b. Copy the entire contents, including `-----BEGIN PRIVATE KEY-----` and `-----END PRIVATE KEY-----`.Paste the private key value into the **Private Key** field on the Datadog OCI integration tile. #### Create OCI metric forwarding stack{% #create-oci-metric-forwarding-stack %} The metric forwarding stack must be manually deployed for **each combination of tenancy and region** to be monitored. For the simplest setup, Datadog recommends creating all the necessary OCI resources with the Oracle Resource Manager (ORM) stack provided below. Alternatively, you can use your existing OCI networking infrastructure. All resources created by Datadog's ORM stack are deployed to the compartment specified, and for the region currently selected in the top right of the screen. 1. Click the **Create Metric Stack** button on the Datadog OCI integration tile. 1. Accept the Oracle Terms of Use. 1. Leave the **Custom providers** option unchecked. 1. Name the stack and select the compartment to deploy it to. 1. Click **Next**. 1. In the **Datadog API Key** field, enter your [Datadog API key](https://app.datadoghq.com/organization-settings/api-keys) value. {% tab title="Create VCN (recommended)" %} In the **Network options** section, Datadog recommends leaving `Create VCN` checked. {% /tab %} {% tab title="Use existing VCN" %} **Optionally**, you can use an existing VCN instead. If you follow this approach, the subnet's OCID must be provided to the stack. Make sure that the VCN: - Is allowed to make HTTP egress calls through NAT gateway. - Is able to pull images from OCI container registry using service gateway. - Has the route table rules to allow NAT gateway and service gateway. - Has the security rules to send HTTP requests. In the **Network options** section, uncheck the `Create VCN` option and enter your VCN information:a. In the **vcnCompartment** field, select your compartment.b. In the **existingVcn** section, select your existing VCN.c. In the **Function Subnet OCID** section, enter the OCID of the subnet to be used. {% /tab %} In the **Metrics settings** section, optionally remove any metric namespaces from collection.In the **Metrics compartments** section, enter a comma-separated list of compartment OCIDs to monitor. Any metric namespace filters selected in the previous step are applied to each compartment.In the **Function settings** section, select `GENERIC_ARM`. Select `GENERIC_X86` if deploying in a Japan region.Click **Next**.Click **Create**.Return to the [Datadog OCI integration tile](https://app.datadoghq.com/integrations/oracle-cloud-infrastructure) and click **Create Configuration**. **Notes**: - By default, only the root compartment is selected, and all of the metric namespaces from Step 8 which are present in the compartment are enabled (up to 50 namespaces are supported per connector hub). If you choose to monitor additional compartments, the namespaces added to them are an intersection of namespaces selected and the namespaces present in the compartment. - You should manage who has access to the Terraform state files of the resource manager stacks. See the [Terraform State Files section](https://docs.oracle.com/iaas/Content/Security/Reference/resourcemanager_security.htm#confidentiality__terraform-state) of the Securing Resource Manager page for more information. {% /collapsible-section %} ## Data Collected{% #data-collected %} ### Metrics{% #metrics %} For a detailed list of metrics, select the appropriate OCI service in the metric namespace section. ### Service Checks{% #service-checks %} The OCI integration does not include any service checks. ### Events{% #events %} The OCI integration does not include any events. ## Troubleshooting{% #troubleshooting-1 %} See the [OCI Integration Troubleshooting guide](https://docs.datadoghq.com/integrations/guide/oci-integration-troubleshooting) to resolve issues related to the OCI integration. ## Further Reading{% #further-reading %} - [Monitor Oracle Cloud Infrastructure with Datadog](https://www.datadoghq.com/blog/monitor-oci-with-datadog/) - [Accelerate Oracle Cloud Infrastructure monitoring with Datadog OCI QuickStart](https://www.datadoghq.com/blog/datadog-oci-quickstart/)