Oracle Cloud Infrastructure Documentation

Enable Diagnostics & Management for Autonomous Databases

Before you enable Database Management Diagnostics & Management for Autonomous Databases, you must:

Note

Certain metrics and Performance Hub features are available free of cost for Autonomous Databases, however, you must enable Diagnostics & Management to use the advanced monitoring and management features, which are available at an additional cost.

To enable Diagnostics & Management for Autonomous Databases in Database Management:

  1. Sign in to the Oracle Cloud Infrastructure console.
  2. At the top of the page, ensure that the region in which you want to enable Diagnostics & Management is selected.
    Note

    Cross-region monitoring and management of Oracle Databases is not available.
  3. Open the navigation menu, click Observability & Management. Under Database Management, click Administration.
  4. On the left pane, select a compartment in the Compartment drop-down list and Autonomous in the Deployment type filter.
  5. On the Managed databases page, click Enable Diagnostics & Management.
  6. In the Enable Diagnostics & Management panel:
    1. Specify the following details to select a database:
      1. Database type: Select Autonomous.
      2. Workload type: Select the Autonomous Database workload type.
      3. Deployment type: Select the Autonomous Database deployment type: Autonomous Serverless or Autonomous Dedicated.
      4. Autonomous Database: Select the Autonomous Database. By default, the compartment selected on the Managed databases page is displayed, however, you can click Change compartment and select another compartment, if required.
      5. Service name: The predefined connection profiles for the Autonomous Database are automatically displayed in the dbname_<service name> (TLS or Mutual TLS) format. The default selection is displayed in the Service name field, however, you can select another option, if required. Note that if mTLS is appended to the service name, then the Database wallet secret field is displayed and you will have to upload the wallet.
      6. Protocol: The TCP or TCPS protocol used to connect to the Autonomous Database is displayed based on the previously selected predefined service name and cannot be edited.
      7. Port: The port number is displayed based on the previously selected predefined service name and cannot be edited.
      8. Database wallet secret: Select the secret that contains the wallet from the drop-down list. This field is only displayed if mTLS is appended to the service name. If an existing secret that contains the wallet is not available, then select Create new secret... in the drop-down list and either automatically download the cwallet.sso file to add it to a secret or manually upload it to a secret. For information on database wallets and how to create a secret in the Oracle Cloud Infrastructure Vault service, see Autonomous Database-related Prerequisite Tasks.

        Note that a resource principal policy is required to grant Managed Database resources the permission to access the secret that contains the database wallet. If the policy is not created, then A policy is required... message is displayed and you can click Add policy to view and automatically add it. The Oracle Cloud Infrastructure IAM service creates the policy and it's added to a collection of policies called DBMgmt_Resource_Policy in the IAM service.

        For information on:

    2. Specify the database credentials for the connection to the selected Autonomous Database.
      1. Database user name: Enter the database user name.
      2. User password secret: Select the secret that contains the database user password from the drop-down list. If the compartment in which the secret resides is different from the compartment displayed, then click Change compartment and select another compartment.

        If an existing secret with the database user password is not available, then select Create new secret... in the drop-down list. The Create password secret panel is displayed and you can create a new secret. For information on database monitoring user credentials and how to save the database user password as a secret in the Vault service, see Autonomous Database-related Prerequisite Tasks.

        Note that a resource principal policy is required to grant Managed Database resources the permission to access the secret that contains the database user password. If the policy is not created, then A policy is required... message is displayed and you can click Add policy to view and automatically add it. The IAM service creates the policy and it's added to a collection of policies called DBMgmt_Resource_Policy in the IAM service.

        For information on:

    3. Select the private endpoint in the Private endpoint drop-down list, which will act as a representation of Database Management in the VCN in which the Autonomous Database can be accessed. If the compartment in which the private endpoint resides is different from the compartment displayed, then click Change compartment and select another compartment.

      You must ensure that the appropriate Database Management private endpoint is available. Here are the two types of Database Management private endpoints:

      • Private endpoint for Autonomous Databases Serverless
      • Private endpoint for Autonomous Databases on Dedicated Exadata Infrastructure

      If an existing Database Management private endpoint is not available, then select Create private endpoint... in the drop-down list to create one. For information on how to create a private endpoint, see Create a Database Management Private Endpoint for Autonomous Databases.

      Note

      The Private endpoint information section in the Enable Diagnostics & Management panel is not displayed if the Secure access from everywhere option is used to configure network access to an Autonomous Database Serverless.
    4. Click Add network security rule to add ingress and egress security rules to an NSG or a Security List, if these rules were not added as part of the prerequisite tasks.

      The security rules are required to enable communication between Database Management and the Autonomous Database. For information on the required Oracle Cloud Infrastructure Networking service permissions, see Permissions Required to Enable Diagnostics & Management for Autonomous Databases.

      In the Add network security rule panel:

      1. Select either Security list or Network security group depending on which security feature you want to use to add security rules.

        Note that the Network security group radio button is only displayed if the Database Management private endpoint and the Autonomous Database have an attached NSG. For an Autonomous Database that has an Access Control List (ACL) defined, the Network security group radio button is displayed if the Database Management private endpoint has an attached NSG.

      2. Select one of the following options in the Ingress rule section and review the details of the ingress rule that will be created:
        • If you've selected the Security list option, select a security list in the Autonomous Database's subnet.
        • If you've selected the Network security group option, select an NSG attached to the Autonomous Database.
        Note

        For an Autonomous Database that has an ACL defined, the Ingress rule section is not displayed as the database automatically accepts connections from addresses on the list and rejects all other client connections.
      3. Select one of the following options in the Egress rule section and review the details of the egress rule that will be created:
        • If you've selected the Security list option, select a security list in the private endpoint's subnet.
        • If you've selected the Network security group option, select an NSG attached to the private endpoint.
      4. Click Submit.

      For general information on how to enable communication using security rules, see Enable Communication Between Database Management and Oracle Cloud Databases.

    5. Click Enable Diagnostics & Management.
A confirmation message with a link to the Work requests section on the Autonomous Database details page is displayed. Click the link to monitor the progress of the work request.

You can verify if Diagnostics & Management is successfully enabled on the Managed databases page. To do so, select the compartment in which the Autonomous Database resides and select Autonomous in the Deployment type filter. After Diagnostics & Management is enabled, the Autonomous Database is listed as a Managed Database. To disable Diagnostics & Management, click the Actions icon (Actions) for the Autonomous Database and click Disable Diagnostics & Management.

Note

If you enabled Diagnostics & Management for Autonomous Databases in Database Management or on the Autonomous Database details page prior to September 2024, you must provide the connection information to use the advanced monitoring and management features. To do so:
  1. Go to the Managed databases page in Database Management.
  2. Click the Actions icon (Actions) for the Autonomous Database and click Edit Diagnostics & Management.