Scenario: Configure Logs for an IoT Flow Runtime

Send Node-RED system-console logs from an IoT Flow Runtime to OCI Logging in the customer tenancy, generate a test message, and verify that the message is available.

Use this scenario to configure durable operational logs for a Flow runtime. Messages sent only to the Node-RED Debug sidebar are available for interactive development while the editor is open. If a log is configured for the Flow runtime, messages are sent to the Node-RED runtime log and delivered to the OCI logging service, view the flow runtime log on the monitoring tab for the flow runtime.

The test flow is Inject -> Debug. The Debug node sends a recognizable message to the runtime log so that you can verify the complete logging path.

Tasks

Configure the Logging Destination
Generate a Node-RED System-Console Message
Verify the Message in OCI Logging

Prerequisites

An active IoT Flow Runtime and access to its Node-RED editor.
An OCI Logging log group in the customer tenancy. To use an existing log, you also need its log OCID.
Permission to update the Flow Runtime and search the selected log.
Before configuring the service log, create the applicable Flow Runtime Logging policies in the compartment containing the log group or an appropriate parent compartment. An existing log requires read log-groups and use log-content. Automatic log creation requires manage log-groups and use log-content.

Step 1: Configuring the Logging Destination

Configure an existing log by providing its log group and log OCIDs, or provide only a log group so that OCI IoT creates the log automatically.

Use one of the following methods to configure the logging destination.

1. On the IoT domains list page, select the domain with the Flow Runtime, and then select Flow runtimes.
2. Select the Flow Runtime name, and then select Edit.
3. In Configure logging, select one of the following options:
  - Use an existing log: Select or enter the log group and log.
  - Create a log automatically: Select or enter only the log group.
4. Select Save changes and wait for the update work request to succeed.
To use an existing log, save this content as log-config.json:
```
{
  "logGroupId": "<log-group-ocid>",
  "logId": "<log-ocid>"
}
```
To create a log automatically, omit logId:
```
{
  "logGroupId": "<log-group-ocid>"
}
```
Update the Flow Runtime:
```
oci iot flow-runtime update \
  --iot-flow-runtime-id <flow-runtime-ocid> \
  --log-config file://log-config.json \
  --wait-for-state SUCCEEDED
```
Note

Providing --log-config replaces the complete logging configuration. Get the Flow Runtime first if you need to preserve or record the current configuration.

For all options, see CLI Command Reference.
Run the UpdateIotFlowRuntime operation. To use an existing log, provide both OCIDs:
```
PUT /20250531/iotFlowRuntimes/{iotFlowRuntimeId}
{
  "logConfig": {
    "logGroupId": "<log-group-ocid>",
    "logId": "<log-ocid>"
  }
}
```
To create a log automatically, omit logId:
```
PUT /20250531/iotFlowRuntimes/{iotFlowRuntimeId}
{
  "logConfig": {
    "logGroupId": "<log-group-ocid>"
  }
}
```
Monitor the work request returned by the update until it succeeds. A supplied logConfig replaces the complete logging configuration.

Step 2: Generating a Node-RED System-Console Message

On the Flow Runtime details page, select Open Flow runtime editor.
Add an Inject node and a Debug node, and connect them.
Configure the Inject node to send this string in msg.payload:
```
OCI IoT Flow Runtime logging test
```
Configure the Debug node to output msg.payload to the system console or runtime log.
Output sent only to the Debug sidebar isn't delivered to OCI Logging. For more information about the Debug node and runtime-log output, see The Core Nodes in the Node-RED documentation.
Select Deploy, and then trigger the Inject node.
Record the time that you triggered the node so that you can use a narrow Logging search time range.

Step 3: Verifying the Message in OCI Logging

Log delivery can take a short time. Search a time range that begins before you triggered the Inject node and look for OCI IoT Flow Runtime logging test.

Use one of the following methods to search the configured OCI log.

1. On the Flow Runtime details page, under Monitoring, select Logs.
2. Select the configured log name to open it in OCI Logging.
3. Set the time range to include the time that you triggered the Inject node.
4. Search the log records for OCI IoT Flow Runtime logging test.
Use the logging-search search-logs command. Supply UTC timestamps that include the time that you triggered the Inject node.
```
oci logging-search search-logs \
  --search-query 'search "<compartment-ocid>/<log-group-ocid>/<log-ocid>" | sort by datetime desc' \
  --time-start <start-time-rfc3339> \
  --time-end <end-time-rfc3339>
```
Confirm that the response contains OCI IoT Flow Runtime logging test. For all options, see search-logs.

Run the OCI Logging SearchLogs operation with a time range that includes the test.

POST /20190909/searchLogs
{
  "searchQuery": "search \"<compartment-ocid>/<log-group-ocid>/<log-ocid>\" | sort by datetime desc",
  "timeStart": "<start-time-rfc3339>",
  "timeEnd": "<end-time-rfc3339>"
}

Confirm that the returned log records contain OCI IoT Flow Runtime logging test.

Troubleshooting

If OCI IoT doesn't create a log after you select only a log group, confirm that the automatic log creation policies grant manage log-groups and use log-content and apply to the compartment containing the log group or an appropriate parent compartment.
If the log exists but the test record is missing, confirm that the Flow Runtime is active, the Debug node writes to the system console or runtime log, the flow is deployed, and you triggered the Inject node.
Expand the search time range and confirm that you are searching the configured compartment, log group, and log.
For authorization failures, review the Flow Runtime logging policies and Flow Runtime policy troubleshooting.

If the problem continues, record the Flow Runtime OCID, log group and log OCIDs, work request OCID, request ID, test timestamp, and error message before contacting Oracle Support.

FAQs

Should I select an existing log or let OCI IoT create one?: Select an existing log when you need a known log name, retention setting, or established operational process. Specify only the log group when OCI IoT should create and manage the log destination.
Why is a Debug-sidebar message missing from OCI Logging?: The Debug sidebar is an editor view. Configure the Debug node to write to the system console or runtime log, deploy the flow, trigger it again, and then search the configured OCI log.
What permission is required for automatic log creation?: The automatic log creation policies must grant manage log-groups and use log-content in the compartment containing the log group or an appropriate parent compartment. If you use an existing log instead, the policies must grant read log-groups and use log-content.
Does changing the log configuration preserve the previous destination?: The Flow Runtime sends new system-console records to its current log configuration. Record the previous log group and log OCIDs before replacing the configuration if you need to search historical records.

For reusable logging questions, see Flow Runtimes FAQs.

Oracle Cloud Infrastructure Documentation