1Z0-997-25 Question 160
Single answerYour organization runs a containerized application on Oracle Container Engine for Kubernetes (OKE) and uses Oracle Cloud Infrastructure Logging for capturing application logs. You created an alarm in Oracle Cloud Infrastructure Monitoring to alert on specific error messages, but the alarm never fires even when those errors appear in the logs. Which step must you ensure is completed so that the alarm can be triggered by these log events?
- A
Assign the alarm a dynamic group policy with read-only access to all logs in the tenancy.
- B
Configure a custom log-based metric or a service connector that transforms log events into metrics recognized by the alarm.
- C
Enable log retention at the namespace level to persist logs for at least 90 days.
- D
Use an Event Rule to directly create an alarm on each log event containing an error.
Show answer and explanation
Correct answer: B
Explanation
In Oracle Cloud Infrastructure, alarms are designed to monitor metrics rather than raw logs. To alert on specific log-based conditions, you must first convert log events into metrics that OCI Monitoring can read. This can be done by creating custom log-based metrics or using a service connector (via the Service Connector Hub) to send log data to Monitoring as metrics. Oracle Cloud� documentation on �Logging to Monitoring� covers this process in detail and is key to ensuring alarms correctly trigger on log-derived conditions.
- A. Incorrect.
Option 1 is incorrect because giving the alarm a dynamic group policy with read-only access does not convert log data into metrics. Alarms in OCI rely on metrics, not raw logs, to trigger alerts. Simply granting access to logs will not cause the alarm to fire.
- B. Correct.
Option 2 is correct because alarms in OCI Monitoring only trigger on metrics. Logs must be converted into metrics using a custom log-based metric or a service connector that routes log data to OCI Monitoring. Once these metrics are available, the alarm can be configured to monitor them and fire if a threshold is exceeded.
- C. Incorrect.
Option 3 is incorrect because adjusting log retention helps maintain historical log data, but it does not help the alarm service recognize log events as metrics. The alarm will still not fire unless logs are translated into a metric the alarm can monitor.
- D. Incorrect.
Option 4 is incorrect because OCI Event Rules currently cannot create alarms directly from logs. You must have metrics in OCI Monitoring for the alarm to function. Event Rules can forward events to other services or functions, but that does not create metrics for the alarm.