Is audit logging included?
Yes, audit logging is included by default and is free of charge in Oracle Cloud Infrastructure (OCI). Unlike some cloud providers that charge for the ingestion or storage of management-level events, OCI considers audit logs a fundamental part of the security architecture.
Here is how the included audit logging works as of 2026:
The moment you create an OCI tenancy, the Audit service begins recording all API calls.
Scope: It captures every "write" action (like creating a VM or deleting a database) and "read" action (like listing users or viewing policy details).
Zero Configuration: You don't need to "turn on" audit logs; they are always active to ensure you have a forensic trail from day one.
OCI provides a generous retention window for these audit logs:
Default Retention: Audit logs are retained for 365 days (one full year) at no cost.
Storage: These logs do not count against your Object Storage bucket limits or your standard logging storage tiers.
Note: While the Audit service retains logs for 365 days, the Identity (IAM) domain reports (like login history) may have a shorter default window (often 30–90 days) but can be extended to match the full year.
Every audit event is recorded in a standardized JSON format (NIST-compliant) and includes:
Who: The OCID of the user or service that made the request.
What: The specific API action (e.g., CreateInstance).
When: An accurate timestamp.
From Where: The source IP address and user agent.
Result: Whether the action succeeded or failed (with error codes).
While the Audit service (API events) is free, OCI's broader Logging service has a tiered pricing model:
Audit Logs: FREE (Always included).
Service Logs: (e.g., Load Balancer logs, VCN Flow logs) FREE for the first 10 GB per month, then ~$0.05 per GB.
Custom Logs: (e.g., logs from your application or OS) FREE for the first 10 GB per month, then ~$0.05 per GB.
| Feature | OCI Audit Service | OCI Logging Service |
| Cost | $0 (Included) | First 10 GB free; then ~$0.05/GB |
| Retention | 365 Days | Configurable (Default 30 days) |
| Capture Level | Control Plane (API Actions) | Data Plane (Traffic, Apps, OS) |
| Enablement | Automatic | Manual (Opt-in) |
If your industry (like Finance or Healthcare) requires you to keep audit logs for 7 years or more, the best practice is to use a Service Connector. You can set a rule to automatically move your audit logs from the free Audit service into an Archive Storage bucket. While the archive bucket costs a few cents per GB, it allows you to maintain a permanent, immutable record for a decade or more.