oracle / oracle/oci-java-sdk

VCN Flow Logs Configured Correctly but Query Returns No Results

Open
#668 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Logging Analytics
Dominant language
Java
Stars
243
Forks
171
Avg merge
30m
Merged PRs (30d)
4

Description

Environment

oci-java-sdk Version: 3.54.0

Description
I have configured VCN Flow Logs through the Java SDK to monitor network traffic, but queries return null results despite correct configuration.
Steps Taken

Created log groups for each region
Created flow logs for each VCN using the following configuration:
javaCopyOciService source = OciService.builder()
.service("flowlogs")
.resource(vcnId)
.category("vcn")
.build();

Confirmed the log is properly enabled:
CopyLog Name: flow-log-oci-start-pro-vcn
Enabled: true
Log Type: Service
Lifecycle State: Active

Attempted various query formats including:
Copysearch "compartmentId/logGroupId"
search "compartmentId/logGroupId" | where service='flowlogs'
search "compartmentId/logGroupId" | where data.category='vcn'

All queries consistently return null results

Troubleshooting

Verified logs are in "Enabled" state and "Active" lifecycle state
Tried queries with extended time ranges (7-30 days)
Confirmed there is actual network traffic on the VCNs
Used multiple query syntax variations based on Oracle documentation
Used Java SDK, OCI CLI, and Console to attempt log retrieval

Expected Behavior
Queries should return flow log data for the VCNs when network traffic is present.
Actual Behavior
All queries return null results despite logs being correctly configured and enabled.
Possible Causes

Undocumented delay in log collection beyond the expected timeframe
Potential mismatch between log configuration parameters and query syntax
Issues with log indexing or processing on the backend
Possible API/SDK limitations for flow logs in this region

Request
Please advise on:

Expected timeframe for flow logs to begin showing data after configuration
Correct query syntax for retrieving flow logs with the provided configuration
Any additional steps needed to ensure log collection is working properly
Any known issues with flow logs in this region or service

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the OCI Java SDK 3.54.0 flow-log configuration shown in the issue, then compare the same setup and queries in the OCI CLI and Console. Check the expected collection timeframe, query syntax, and regional behavior; done means identifying the cause of the null results or documenting the confirmed service limitation.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
cloud, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.