Overview

Oracle Cloud Infrastructure (OCI) is an infrastructure-as-a-service (IaaS) and platform-as-a-service (PaaS) used by enterprise-scale companies. With a full suite of managed services for hosting, storage, networking, databases, and more.

Use Datadog’s OCI integration to forward your logs and metrics to Datadog, where they can power dashboards, help with troubleshooting, and be monitored for security and compliance posture.

Setup

Metric collection

To forward your OCI metrics to Datadog:

• Enter tenancy info
• Create OCI policy stack in the home region of your tenancy to create a Datadog auth user, group, and policies
• Enter DatadogROAuthUser info in Datadog
• Create OCI metric forwarding stack for every tenancy region you want to forward metrics from

For a visual representation of this architecture, see the Architecture section.

Enter tenancy info

Enter the OCID and home region of the tenancy you want to monitor in the Datadog OCI integration tile.

• You can find this information on the Tenancy details page.
• Enter the home region using the Region Identifier value from the OCI Regions and Availability Domains page.

Create OCI policy stack

This policy stack should only be deployed once per tenancy.

1. Click the Create Policy Stack button on the Datadog OCI integration tile.
2. Accept the Oracle Terms of Use.
3. Leave the option to use custom Terraform providers unchecked.
4. Use the default name and compartment for the stack, or optionally provide your own descriptive name or compartment.
5. Click Next.
6. Leave the tenancy field and current user field as-is.
7. Click Next.
8. Click Create.

Enter DatadogROAuthUser info

1. In the OCI console search bar, search for DatadogROAuthUser and click on the User resource that appears.
2. Copy the user’s OCID value.
3. Paste the value into the User OCID field in the Datadog OCI integration tile.
4. Returning to the OCI console, generate an API key with these steps: a. In the bottom left corner of the screen, under Resources, click API keys. b. Click Add API key. c. Click Download private key. d. Click Add. e. A Configuration file preview popup appears, but no action is needed; close the popup.

5. Copy the fingerprint value, and paste it into the Fingerprint field on the Datadog OCI integration tile.
6. Copy the private key value with these steps: a. Open the downloaded private key .pem file in a text editor, or use a terminal command such as cat to display the file’s contents. b. Copy the entire contents, including -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----.
7. Paste the private key value into the Private Key field on the Datadog OCI integration tile.

Create OCI metric forwarding stack

The metric forwarding stack must be deployed for each combination of tenancy and region to be monitored. For the simplest setup, Datadog recommends creating all the necessary OCI resources with the ORM stack provided below. Alternatively, you can use your existing OCI networking infrastructure.

All resources created by Datadog’s ORM stack are deployed to the compartment specified, and for the region currently selected in the top right of the screen.

1. Click the Create Metric Stack button on the Datadog OCI integration tile.
2. Accept the Oracle Terms of Use.
3. Leave the Custom providers option unchecked.
4. Name the stack and select the compartment to deploy it to.
5. Click Next.
6. In the Datadog API Key field, enter your Datadog API key value.

8. In the Metrics settings section, optionally remove any metric namespaces from collection.
9. In the Metrics compartments section, enter a comma-separated list of compartment OCIDs to monitor. Any metric namespace filters selected in the previous step are applied to each compartment.
10. In the Function settings section, select GENERIC_ARM. Select GENERIC_X86 if deploying in a Japan region.
11. Click Next.
12. Click Create.
13. Return to the Datadog OCI integration tile and click Create Configuration.

Notes:

• By default, only the root compartment is selected, and all of the metric namespaces supported by the Datadog OCI integration are enabled (up to 50 namespaces are supported per connector hub). If you choose to monitor additional compartments, any metric namespace exclusion filters are applied to each compartment.
• You should manage who has access to the Terraform state files of the resource manager stacks. See the Terraform State Files section of the Securing Resource Manager page for more information.

Validation

View oci.* metrics in the OCI integration overview dashboard or Metrics Explorer page in Datadog.

Configuration

Add regions

To monitor an additional region in a tenancy, navigate to that tenancy in the OCI Integration tile.

1. In the Configure an Additional Region section, click Create Metric Stack.
2. Switch to the region you wish to monitor in the top right of the screen.
3. Complete the steps in Create OCI metric forwarding stack for the new region.

Add compartments or metric namespaces

To add compartments or edit the list of metric namespaces enabled, click Edit on the newly created Connector Hub.

• Click + Another compartment to add compartments.
• In the Configure source section, add or remove namespaces from the Namespaces dropdown.

Architecture

Metric forwarding resources

This integration creates an OCI connector hub, function app, and secure networking infrastructure to forward OCI metrics to Datadog. The ORM stack for these resources creates a function container repository for the region in the tenancy, and the Docker image is pushed to it to be used by the function.

IAM resources

This integration creates:

• A dynamic group with resource.type = 'serviceconnectors', to enable access to the connector hub.
• A user called DatadogROAuthUser, which Datadog uses to read tenancy resources.
• A group to which the created user is added for policy access.
• A user called DatadogAuthWriteUser, which is used to push Docker images for the function.
• A write access group that the DatadogAuthWriteUser is added to, for pushing images through policy access.
• A policy in the root compartment to allow connector hubs to read metrics and invoke functions. This policy also gives the created user group read access to both the tenancy resources and write access group, to push images. The following statements are added to the policy:

Allow dynamic-group Default/<GROUP_NAME> to read metrics in tenancy
Allow dynamic-group Default/<GROUP_NAME> to use fn-function in tenancy
Allow dynamic-group Default/<GROUP_NAME> to use fn-invocation in tenancy
Allow group Default/<USER_GROUP_NAME> to read all-resources in tenancy
Allow group Default/<WRITE_USER_GROUP_NAME> to manage repos in tenancy where ANY {request.permission = 'REPOSITORY_READ', request.permission = 'REPOSITORY_UPDATE', request.permission = 'REPOSITORY_CREATE'}

Metric namespaces

Log collection

Send logs from your Oracle Cloud Infrastructure to Datadog by following either process:

Data Collected

Metrics

Service Checks

The OCI integration does not include any service checks.

Events

The OCI integration does not include any events.

Troubleshooting

Need help? Contact Datadog support.

Further Reading

Additional helpful documentation, links, and articles:

• Monitor Oracle Cloud Infrastructure with Datadog