Logging
The Logging domain tests collection, routing, and search: which logs are on by default, how service logs differ from agent logs, and how retention and access are controlled. OCI Logging organizes logs into regional log groups. A log is a source plus configuration: service logs (VCN flow logs, audit, load balancer, object storage), custom logs, and agent logs. Audit logs are enabled by default and cannot be disabled. Most other service logs must be enabled on the resource and assigned to a log group.
Agent and service logs
Service logs are emitted by the service itself; you enable them and choose the compartment and log group. Agent logs come from the Unified Monitoring Agent on a compute instance, using a configuration with sources, parsers, and destinations. The agent needs a dynamic group and IAM policies that allow the instance principal to read the configuration and write to the destination. Logging Analytics is a separate service for indexing and parsing; Logging itself is for collection, search, and routing.
Worked example
You must capture VCN flow logs for a subnet and keep them for 90 days. Create a log group in the VCN's compartment, enable the VCN flow log, select the log group, and set retention to 90 days. Reasoning: flow logs are a service log, so no agent is needed; the log group controls access and retention; flow logs are enabled per VCN or subnet, not globally by default.
Traps
Assuming audit logs need enabling; forgetting that a log group is regional; expecting agent logs without policies; confusing Logging retention with Object Storage lifecycle; and enabling a service log in a compartment different from the one the resource owner expects.