---
title: Install and configure OCI log forwarding
source: https://docs.newrelic.com/docs/logs/forward-logs/oci-log-forwarding
---

Use this guide to send OCI service and audit logs to New Relic. To send metrics as well, see [Monitor OCI metrics and logs](https://docs.newrelic.com/docs/infrastructure/oci/install-metrics-and-logs). To send only metrics, see [Monitor OCI metrics](https://docs.newrelic.com/docs/infrastructure/oci/install-metrics).

## Compatibility and requirements [#requirements]

Before you begin, make sure you have:

-   A New Relic account with infrastructure monitoring permissions in a supported region (US, EU, or JP)
-   A valid New Relic [ingest license key](https://docs.newrelic.com/docs/apis/intro-apis/new-relic-api-keys/#ingest-license-key) and [user key](https://docs.newrelic.com/docs/apis/intro-apis/new-relic-api-keys/#user-api-key)
-   An OCI tenancy with an Identity and Access Management (IAM) domain, and temporary administrative access to that domain and the root compartment, enough to complete Workload Identity Federation (WIF) setup, the mechanism New Relic uses to authenticate without storing long-lived credentials. You can revoke this access once setup is complete.
-   Your OCI tenancy OCID and home region (for example, `us-ashburn-1`)
-   An OCI API signing key (only if you're deploying with Terraform)

## Guided installation [#ui-install]

Guided installation is available at **[one.newrelic.com](https://one.newrelic.com) > Integrations & Agents > Oracle Cloud Infrastructure**. The UI walks you through connecting your OCI account, then instrumenting the log groups you want to monitor.

### Choose the logs data type

Follow these steps:

1.  Select **Logs** (for detailed event and audit records).
2.  Click **Continue**.

### Choose your integration method and configure the integration

Select your preferred integration method to ingest OCI logs into New Relic based on your organizational needs:

**Monitor OCI with Oracle Resource Manager**

Runs Oracle Resource Manager stacks to provision what the integration needs, instead of you creating each piece by hand in the OCI console.
Follow the on-screen instructions to establish the connection.

**Manually integrate your OCI account**

In the OCI console create the required policies and service connectors. The guided installation walks you through these steps in order: create a compartment, create a dynamic group, set up a key vault secret, create a policy, set up a network, set up the logs function, set up an audit logs connector (optional), set up the logs connector, set up WIF, and create the connection.

You will need the following information to complete the process:

-   Name the dedicated compartment as `newrelic_compartment_DO_NOT_REMOVE`. Create it in your OCI home region.
-   While creating the dynamic group in the root compartment under the default domain, add the rules `resource.type = 'serviceconnector'` and `resource.type = 'fnfunc'`.
-   Create a key vault to securely store your New Relic license key and user key for authentication.
    1.  **Create a key vault**. In the OCI console, locate and access the **Key Management and Vault services** and create a vault in the compartment you created earlier, naming it (for example, `newrelic-vault`) and choosing a standard or virtual private vault based on your security requirements.
    2.  **Create a master encryption key**. In the vault, create a master key named (for example) `newrelic-encryption-key`, using the `AES` algorithm and a `256`-bit key length.
    3.  **Create secrets for your API keys**. Create a secret for your New Relic ingest license key, named (for example) `newrelic-ingest-key`, selecting the master key you just created and pasting your ingest license key as the secret content (Plain Text). Repeat to create a second secret for your New Relic user key, named (for example) `newrelic-user-key`, pasting your user key as the secret content (Plain Text).
-   Create a serverless application and deploy the New Relic function that processes and forwards your OCI logs.
    1.  **Create a serverless application for logging**
        -   Access the **Functions** service under **Developer Services** in the OCI console.
        -   Create a new application with this configuration:
            -   **Name**: a descriptive name (for example, `newrelic-logging-function-app`)
            -   **Compartment**: your designated New Relic compartment
            -   **VCN**: the VCN created for the New Relic integration
            -   **Subnet**: the private subnet, for secure connectivity
            -   **Shape**: `GENERIC_X86`, for the application shape
        -   Save the application configuration.
    2.  **Configure environment variables for logging**
        -   Within the application settings, go to the configuration section and add these variables:
            -   `VAULT_REGION`: the region where you created your key vault
            -   `DEBUG_ENABLED`: `false` for production use (or `true` for debugging)
            -   `NEW_RELIC_REGION`: your New Relic region (`US`, `EU`, or `JP`)
            -   `SECRET_OCID`: the OCID of your New Relic license key secret from the key vault
            -   `CLIENT_TTL`: `30` seconds, for the license key refresh interval
        -   Optionally, to enable [self-observability metrics on the log forwarder](https://docs.newrelic.com/docs/logs/forward-logs/oci-log-forwarder-observability), also add
            -   `FORWARDER_METRICS_TIER`: Controls which self-observability metrics the forwarder emits. Defaults to `basic`. Refer to the [metric tiers](https://docs.newrelic.com/docs/logs/forward-logs/oci-log-forwarder-observability/#metric-tiers) for what each setting collects.
            -   `TENANCY_NAME`: Identifies your OCI tenancy by its display name, tagging the forwarder's metrics so you can tell tenancies apart if you monitor more than one.
            -   `COMPARTMENT_NAME`: Identifies, by display name, the compartment where you deployed the logs function, tagging metrics for per-compartment breakdowns. If you deployed into the tenancy's root compartment, use the same value as `TENANCY_NAME`.
        -   Once you enable forwarder metrics, [import the observability dashboard](https://docs.newrelic.com/docs/logs/forward-logs/oci-log-forwarder-observability/#observability-dashboard) to visualize them.
        -   Save the configuration variables.
    3.  **Deploy the logging function**
        -   Create a new function within the application with these specifications:
            -   **Function name**: a descriptive name (for example, `newrelic-logging-function`)
            -   **Image source**: the New Relic logging Docker image, which you copy into a private repository in your Container Registry
            -   **Memory allocation**: at least 128 MB
            -   **Timeout**: 300 seconds, for adequate processing time
        -   For the Docker image, pull a specific version of the New Relic log-forwarder image from Docker Hub (not :latest — check Docker Hub's tags page for the current version) and push it into your own Container Registry under that same version tag.
        -   Tag and push the image to a private repository in your namespace in the same region as the function, and reference it in your function configuration.
        -   Complete the function creation and deployment process.
        -   To upgrade later, push the new image again and update the function to use it.
    4.  **(Optional) Enable function logging**
        -   Access the monitoring settings for your function application.
        -   Enable function invocation logs by selecting or creating an appropriate log group, configuring log retention and access policies, and activating log collection for the function.
        -   For more information, see the Oracle documentation on [exporting function log files](https://docs.oracle.com/en-us/iaas/Content/Functions/Tasks/functionsexportingfunctionlogfiles.htm).

**Automate with Terraform**

Terraform is the recommended setup method for logs.
For the detailed integration steps, refer to the [OCI cloud integration guide](https://registry.terraform.io/providers/newrelic/newrelic/latest/docs/guides/cloud_integrations_guide#oci).

### Instrument your log groups

Once you create the connection, the OCI page in New Relic shows a logs view with an **Add instrumentation** control:

1.  Click **Add instrumentation**, filtered to **Not instrumented** tab by default.
2.  Expand a compartment to see its individual log groups, and select the ones you want to monitor. You can also turn on **Enable audit logs** to include OCI audit logs.
3.  Confirm your selection. New Relic shows a summary of how many compartments and log groups you're about to instrument. Then click **Deploy to OCI**.
4.  After the deployment finishes in OCI, the compartment moves to the **Instrumented** tab, and its data appears at **[one.newrelic.com](https://one.newrelic.com) > Infrastructure > OCI**.

Data can take up to 30 minutes to appear. If you don't see it after that, check the deployment status in the OCI console.

To instrument additional log groups later, return to the OCI page in New Relic and repeat these steps.

### Find and use your data

Once your data starts appearing at **[one.newrelic.com](https://one.newrelic.com) > Infrastructure > OCI**, confirm the integration is working and put it to use:

1.  Verify that your OCI account appears in the integrations list.
2.  Confirm that you're receiving logs by checking either of these places:

    -   The [logs UI](https://one.newrelic.com/launcher/logger.log-launcher): go to **[one.newrelic.com](https://one.newrelic.com) > Logs** and confirm that your OCI logs appear.
    -   The [NRQL query tools](https://docs.newrelic.com/docs/chart-builder/use-chart-builder/choose-data/use-advanced-nrql-mode-specify-data): run a NRQL query like this:

        ```sql
        SELECT * FROM Log
        ```
3.  [Create alert conditions](https://docs.newrelic.com/docs/alerts/create-alert/create-alert-condition/alert-conditions) to get proactive notifications about issues in your logs.
4.  [Build custom dashboards](https://docs.newrelic.com/docs/query-your-data/explore-query-data/dashboards/introduction-dashboards/) to visualize your OCI log data and monitor trends.

If you don't see data after 30 minutes, see [Troubleshooting](https://docs.newrelic.com/docs/infrastructure/oci/troubleshoot).

## Related articles [#related-articles]

-   [Introduction to the OCI integration](https://docs.newrelic.com/docs/infrastructure/oci/introduction): Overview of the OCI integration and its setup options.
-   [Monitor your OCI log forwarder](https://docs.newrelic.com/docs/logs/forward-logs/oci-log-forwarder-observability): Enable self-observability metrics on the log forwarder function and import a dashboard to monitor its health.
-   [Uninstall the OCI integration](https://docs.newrelic.com/docs/infrastructure/oci/uninstall): Remove the resources created by the integration and unlink your account.
-   [Troubleshooting](https://docs.newrelic.com/docs/infrastructure/oci/troubleshoot): Fixes for not seeing data and for trust-configuration conflicts during setup.