OCI Observability Professional key terms

A string label that groups related metrics, such as oci_computeagent or oci_lb, so that queries and policies can target one service's measurements without naming every metric individually.

A time-stamped numeric measurement emitted for a resource, identified by namespace, metric name, and a set of dimension key-value pairs. Metrics are aggregated over intervals and retained per the service's retention rules.

A key-value attribute attached to a metric that identifies the source, such as resourceId, availabilityDomain, or faultDomain. Dimensions let a single metric name carry many independent time series.

Monitoring Query Language: the expression syntax used to select metrics, apply functions such as rate, mean, or percentile, and combine series. It appears in alarm queries, charts, and the Monitoring API.

The MQL expression inside an alarm that defines which metric streams are evaluated and how they are reduced, for example averaging CPU utilization across instances in a compartment.

The time window over which raw metric data points are combined before evaluation, commonly one or five minutes. Shorter intervals react faster but are noisier and can trigger more false positives.

A Monitoring resource that evaluates a metric query against a threshold over a rolling window and transitions between OK, FIRING, and sometimes RESET states, notifying configured destinations on state change.

The threshold logic in an alarm, including operator, value, breach duration, and the number of consecutive evaluation windows that must be breached before the alarm fires.

The recurring process in which the Monitoring service runs an alarm's query, compares results to the trigger rule, and updates alarm state. Evaluation frequency is tied to the alarm's interval setting.

The length of time a threshold must remain breached before an alarm moves to FIRING, filtering out brief spikes. It is expressed in minutes and combined with the evaluation interval.

A label such as CRITICAL, WARNING, or INFO attached to an alarm so notifications and dashboards can be prioritized and routed differently by urgency.

An alarm whose state is derived from the states of other alarms using Boolean operators, reducing noise by firing only when several conditions coincide or when a group of alarms is unhealthy.

A scheduled window during which an alarm does not notify, used for planned maintenance so expected outages do not page responders. Suppressed alarms still evaluate but notifications are withheld.

The policy that tells the Management Agent which metrics to collect and which logs to ingest from a compute instance, including custom metric definitions and log source paths.

A user-defined metric pushed to the Monitoring service through the API, CLI, or agent, useful for application-specific signals such as queue depth or business transaction counts.

A Monitoring feature that probes a URL or port from multiple global vantage points and reports availability, latency, and status codes as metrics without requiring an agent.

The practice of continuously testing whether an endpoint responds correctly from outside the tenancy, complementing internal resource metrics. Results feed dashboards and alarms for reachability.

Scripted or scripted-browser transactions executed on a schedule to verify user journeys end to end, producing pass/fail and timing data that internal metrics cannot reveal.

A logical container in Logging that holds related logs and carries its own retention and access settings. Every log must belong to exactly one log group.

A named collection of log entries within a log group, usually corresponding to one source such as an instance's system log or an audit stream. Logs are the unit agents and connectors write to.

A single record inside a log consisting of a timestamp, message data, and optional metadata. Entries are what search queries, saved searches, and connectors process.

The agent installed on compute instances that collects both metrics and logs and forwards them to Monitoring and Logging, replacing separate collection agents.

A log emitted automatically by an Oracle Cloud Infrastructure service, such as VCN flow logs or Object Storage access logs, which must be enabled on the source resource before entries appear.

The immutable record of API activity in a tenancy, capturing who did what, when, and from where. It is retained for a fixed period and is central to security investigations.

A stored Logging query, including filters and time range, that can be rerun or referenced by dashboards and connectors to select which entries flow onward.

The configured period for which log entries remain queryable before automatic deletion. Longer retention costs more and must be planned against compliance requirements.

A resource that reads data from a source such as Logging or Streaming, optionally runs a task like filtering or anonymizing, and delivers results to a target such as Object Storage or Notifications.

The origin of data for a service connector, for example a log group, a stream, or Monitoring metrics. The source defines the shape of records the connector moves.

An optional transformation applied in flight by a service connector, such as filtering records by a condition, masking fields, or converting format before delivery.

The destination a service connector writes to, such as an Object Storage bucket, a Streaming stream, a Functions function, or a Notifications topic. One connector has one target.

A publish-subscribe channel in the Notifications service to which messages are published and from which subscriptions deliver them by email, HTTPS, SMS, or function invocation.

An endpoint registered against a notification topic, such as an email address or webhook URL. Each subscription must confirm before it receives messages.

An HTTPS subscription endpoint that receives notification payloads, commonly used to open incident tickets or trigger automation when an alarm fires.

The top-level container in Application Performance Monitoring that holds traces, spans, and configuration for one application environment and defines its data upload credentials.

The complete record of one request as it travels across services, composed of nested spans. Traces reveal latency distribution and where failures originate in a distributed system.

A single timed operation within a trace, such as a database call or HTTP request, with start time, duration, attributes, and parent-child relationships to other spans.

The library or collector that instruments an application, captures spans, and uploads them to an APM domain using a data key and private endpoint.

An APM or Monitoring resource that runs scripted browser or network tests on a schedule to validate availability and performance from external locations.