Enable Diagnostics & Management for Autonomous AI Databases

When this filter is applied, the Autonomous AI Databases in the selected compartment are listed on the Managed databases page.

1. Specify the following details to select a database:
   1. In the Telemetry section, select Cloud Infrastructure.
   2. In the Database type drop-down list, select Autonomous AI Database.
   3. In the Services section, ensure that Database Management is selected. Optionally, select Ops Insights to enable it for the Autonomous AI Database.
      Note
      
      

      • If a service is already enabled for the selected database, its enablement request is skipped.
      • If you select Ops Insights, data from newly enabled resources may take up to 24 hours to appear in Ops Insights.
   4. In the Compartment drop-down list, select the compartment that contains the Autonomous AI Database.
   5. In the Autonomous AI Databases section, select the checkbox for each database for which you want to enable the selected services. Review the available service-status columns before selecting the databases.

      If Prerequisites displays Incomplete for a selected database, perform the following steps for that database:

      1. Click the Actions icon () and then click Set connection properties.
      2. In the Set full feature credentials panel, ensure that Local database credential is selected and specify the database credentials for the connection to the selected Autonomous AI Database:
         Note
         
         When enabling Database Management and Ops Insights together, use local database credentials. To use IAM credentials for Ops Insights, enable Ops Insights separately, and then enable Database Management in a separate flow.
         1. Database user name: Enter the monitoring user name.
         2. Database user password secret compartment: From the drop-down list, select the compartment that contains the database user password secret.
         3. Database user password secret: Select the secret that contains the database user password.

            If an existing secret with the database user password is not available, then click Create new password secret. The Create password secret panel is displayed and you can create a new secret. For information on database monitoring user credentials and how to save the database user password as a secret in the Vault service, see Autonomous AI Database-related Prerequisite Tasks.

            Note that a resource principal policy is required to grant Managed Database resources the permission to access the secret that contains the database user password. If the policy is not created, then A policy is required... message is displayed and you can click Add policy to view and automatically add it. The IAM service creates the policy and it's added to a collection of policies called DBMgmt_Resource_Policy in the IAM service.

            For information on:

            • Vault service permissions required to use existing secrets or create new secrets, see Permissions Required to Enable Diagnostics & Management for Autonomous AI Databases.
            • IAM policies, see Managing Policies.
         4. Connection string: Review the automatically populated connection string.
      3. In the Database Management connection section, specify the following details:
         1. Service name: Select the predefined connection profile for the Autonomous AI Database. The profiles are displayed in the dbname_<service name> format, with TLS or Mutual TLS appended. If Mutual TLS is appended to the service name, the database wallet fields are displayed.
         2. Protocol: Review the automatically populated protocol. The value is based on the selected service name and cannot be edited.
         3. Port: Review the automatically populated port. The value is based on the selected service name and cannot be edited.
         4. Database wallet secret compartment: If Mutual TLS is appended to the service name, select the compartment that contains the database wallet secret.
         5. Database wallet secret: Select the secret that contains the database wallet. If an existing secret is not available, click Create new secret... to create one.

            Note that a resource principal policy is required to grant Managed Database resources the permission to access the secret that contains the database wallet. If the policy is not created, then A policy is required... message is displayed and you can click Add policy to view and automatically add it. The Oracle Cloud Infrastructure IAM service creates the policy and it's added to a collection of policies called DBMgmt_Resource_Policy in the IAM service.

            For information on:

            • Vault service permissions, see Permissions Required to Enable Diagnostics & Management for Autonomous AI Databases.
            • IAM policies, see Managing Policies.
      4. Click Save changes.
2. If the Connector type section is displayed, select Private endpoint or Management agent, depending on the database configuration.
   Note
   
   

   • Diagnostics & Management is not supported for Autonomous AI Databases with the APEX workload type.
   • For other workloads, the available connection modes depend on the database configuration:
     • For shared Autonomous AI Databases configured with Secure access from everywhere, selecting a connector type is not required.
     • For private or network-restricted shared Autonomous AI Databases, both connection modes are available.
     • For dedicated Autonomous AI Databases, both connection modes are available, including when network access is public.
     • For Autonomous AI Databases on ExaDB-C@C, only Management Agent is available.
   • Private Endpoint: Select this option and then the private endpoint in the Private endpoint drop-down list, which will act as a representation of Database Management in the VCN in which the Autonomous AI Database can be accessed. If the compartment in which the private endpoint resides is different from the compartment displayed, then select another compartment.

     You must ensure that the appropriate Database Management private endpoint is available. Here are the two types of Database Management private endpoints:

     • Private endpoint for Autonomous AI Databases Serverless
     • Private endpoint for Autonomous AI Databases on Dedicated Exadata Infrastructure

     If an existing Database Management private endpoint is not available, then you must create one. For information on how to create a private endpoint, see Create a Database Management Private Endpoint for Autonomous AI Databases.

     Note
     
     The Private endpoint information section in the Enable Diagnostics & Management panel is not displayed if the Secure access from everywhere option is used to configure network access to an Autonomous AI Database Serverless.

     If ingress and egress security rules were not added to an NSG or a Security List as part of the prerequisite tasks, click Add network security rule.

     The security rules are required to enable communication between Database Management and the Autonomous AI Database. For information on the required Oracle Cloud Infrastructure Networking service permissions, see Permissions Required to Enable Diagnostics & Management for Autonomous AI Databases.

     In the Add network security rule panel:

     1. Select either Security list or Network security group depending on which security feature you want to use to add security rules.

        Note that the Network security group radio button is only displayed if the Database Management private endpoint and the Autonomous AI Database have an attached NSG. For an Autonomous AI Database that has an Access Control List (ACL) defined, the Network security group radio button is displayed if the Database Management private endpoint has an attached NSG.

     2. Select one of the following options in the Ingress rule section and review the details of the ingress rule that will be created:
        • If you've selected the Security list option, select a security list in the Autonomous AI Database's subnet.
        • If you've selected the Network security group option, select an NSG attached to the Autonomous AI Database.
        Note
        
        For an Autonomous AI Database that has an ACL defined, the Ingress rule section is not displayed as the database automatically accepts connections from addresses on the list and rejects all other client connections.
     3. Select one of the following options in the Egress rule section and review the details of the egress rule that will be created:
        • If you've selected the Security list option, select a security list in the private endpoint's subnet.
        • If you've selected the Network security group option, select an NSG attached to the private endpoint.
     4. Click Submit.

     For general information on how to enable communication using security rules, see Enable Communication Between Database Management and Oracle Cloud Databases.

   • Management agent: Select the Management Agent in the Management agent drop-down list. If the compartment in which the Management Agent resides is different from the compartment displayed, then select another compartment.

     If a Management Agent is not installed, then you must first install one. For information, see Install Management Agents.

     Note that a resource principal policy is required to grant the agent the permission to access the secret that contains the database wallet. If the policy is not created, then A policy is required... message is displayed and you can click Add policy to view and automatically add it. The IAM service creates the policy and it's added to a collection of policies called DBMgmt_Resource_Policy in the IAM service.

3. Click Enable Diagnostics & Management.

   The Add databases progress panel is displayed. The status of each selected service is displayed separately. Review the status and any associated error messages.

   Note
   
   Keep the panel open until enablement completes for all selected services. If you close it before a service starts, that service will not be enabled. Services already in progress continue. To enable a service that did not start, repeat this procedure and select the same database.
4. Click Close to return to the Managed databases page.