Frequently Asked Questions

General

What is Sauron?

Sauron helps Oracle service teams collect metrics and logs, view dashboards, and route configured alerts. Explore my Sauron explains the tools and first steps.

How do I get started?

If you already have Sauron endpoints, choose a task on the Help home page. To request a new Sauron, post in #sauron-support in the Oracle Slack workspace. If you cannot use that channel, email sauron_dev_ww_grp@oracle.com. Include the details in this checklist so the team can review your request.

What to include in a new Sauron request
  • Short team name or acronym for endpoint domain names, such as fgbu or rsys.
  • Email of your team's VP, contact email addresses, and cost center.
  • Regions where you need Sauron.
  • Existing SSO group, if you have one, or the team name and approver contacts to use when creating OIM entitlements.
  • Components you plan to use, such as metrics, logs, Grafana dashboards, Alertmanager, Shuttleproxy, or OpenSearch.
  • Any hard deadline or customer impact that makes the request urgent.

The SSO group is the team identity used to create OIM entitlements. The Sauron team can help map your team to Admin, Viewer, or Editor entitlements if you do not know the right group name.

For a large regional deployment, also include the number of regions, data centers, scrape targets, expected metrics volume, and expected log volume. The Sauron team can review whether one instance is enough or separate regional instances are needed.

The Sauron team confirms the provisioning schedule after reviewing the request. Once endpoints are provisioned, the provisioner emails the contacts the enabled Help, API, Console, Grafana, Prometheus, Thanos, Alertmanager, OpenSearch, or Kibana URLs.

Would you recommend migrating to Sauron before being fully on OCI?

Your service does not have to be on OCI to use the documented HTTPS ingestion paths. Check network reachability and authentication with Connect my service, then ask the Sauron team to confirm support for your environment before planning a migration.

What is the pricing model?

Ask the Sauron team or your service owner for current charging and cost-center arrangements before planning a new instance.

What OCI services does Sauron integrate with off the shelf?

Sauron uses OCI services to run its own platform. To monitor your OCI service, first check whether it exposes metrics or logs that Sauron can collect. Start with Connect my service; ask the Sauron team about a specific OCI integration before assuming it is built in.

How are responsibilities divided between your team and my team?

The Sauron team:

  • provisions your requested Sauron instance
  • manages backups for supported components according to each instance's configuration and retention settings
  • monitors Sauron health according to its current service coverage
  • provides support through the Sauron support channel.

Your team:

  • provides a metrics source and sends logs from your service
  • chooses the signals and recipients for alerts
  • creates the service's dashboards and alert rules with approved access
  • helps investigate issues in the service's data path.

How is Sauron packaged?

Each managed Sauron has its own Kubernetes namespace and set of web endpoints in an OCI region. Availability depends on the region and tenancy. Include your region in the new Sauron request and confirm availability with the Sauron team. For the technical layout, see Architecture.

What do you offer to help me integrate with Sauron?

Follow Connect my service for the first metric, two logs, dashboard, and delivered test alert.

Is Sauron CSSAP approved?

Ask the Sauron team for the current CSSAP approval record, its scope, and any conditions before relying on it for a new deployment.

What SLAs does Sauron service provide?

Ask the Sauron team for the current service commitment and support terms for your environment. This Help page does not define a contractual SLA.

Does Sauron provide a central console to monitor all my endpoints and its current configuration?

Yes. Console links to this Sauron's endpoints and shows selected health checks, settings, and backup inventory. It cannot verify every problem with your service.

How does a service integrate with Sauron?

Connect my service walks through a metric, two logs, a dashboard, and a delivered test alert in a test Sauron.

Where does Sauron run? Does it run in my tenancy?

Sauron runs on OCI Kubernetes infrastructure managed by the Sauron team. Confirm the tenancy, region, and network boundary for your instance with the Sauron owner when these details affect your security or network review.

What kind of load can Sauron handle?

Capacity depends on the instance size, data volume, labels, retention, and query patterns. For a large deployment, include expected series count, scrape interval, log volume, and retention in your provisioning request so the Sauron team can size it.

Retentions

What is the default online retention period for my Prometheus metrics in Sauron? Is it configurable?

The normal provisioning default is 30 days. If no Prometheus retention value is supplied, the operator fallback is 90 days. With Thanos object storage enabled, the operator's local Prometheus retention default is 48 hours; older metrics are queried through Thanos. Your instance's configured settings take precedence. Check Console Instance.

Retention is configurable through an approved request. Include the Sauron URL, desired period, reason, and expected data volume in your retention-change request.

What is the default online retention period for my logs in Sauron? Is it configurable?

Searchable log retention defaults to 7 days, but your instance may differ. Check Console Instance for its configured value. Request a change in #sauron-support with the Sauron URL, desired period, reason, and expected data volume.

How long are metrics kept in Thanos with downsampling?

With Thanos object storage and downsampling enabled, Sauron's defaults are 30 days for original measurements, 60 days for five-minute summaries, and 90 days for one-hour summaries. These periods overlap, not add together. You can request retention up to one year, subject to approval and the required level of detail. Check your source Sauron's configured settings; see Thanos retention. This is queryable metric retention, separate from backup retention.

What is the default backup retention period for metrics and logs? Are they configurable?

Backup retention depends on the component and your instance. Use Console Recovery to see available backups, then ask the Sauron team for the retention policy if you need a guaranteed historical window. Request changes through #sauron-support.

What is the total retention period for metrics and logs?

Do not add online and backup retention periods to predict the oldest data you can recover. Backups may overlap with online data, and availability depends on the actual backup inventory and restore path. Check the time range you need in Console Recovery and ask the Sauron team if it is not clear.

Can I restore older metrics from the backups outside of the online retention period?

Metric restore requires Sauron-team action and an available backup. Request it in #sauron-support with the Sauron URL, time range, metric scope, reason, and impact window.

Can I restore older logs from the backups outside of the online retention period?

You may be able to restore older logs when the required snapshot is available. Follow Restore OpenSearch Indices to check a snapshot and choose the right restore path.

How can I download my logs from OpenSearch?

Use Download OpenSearch Data to export an index. Check the exported file before deleting or changing any source data.

Where are the backups stored? Are they encrypted?

Backups are stored in OCI Object Storage. OCI Object Storage provides automated encryption in transit and at rest.

Will Sauron automatically retire indices from OpenSearch?

Sauron can retire indices according to the configured log retention period and supported date patterns in index names. An index without a recognized date pattern may not follow the expected lifecycle. Check the naming patterns in Sauron Self-Alerting and the configured period in Console Instance.

What max size a Prometheus can get to before performance significantly downgrades?

There is no single size at which every Prometheus instance slows down. Series count, scrape frequency, retention, storage, and query shape all matter. Check retention in Console Instance, current disk usage in the My Prometheus Grafana dashboard, and ingestion and query behavior before increasing load. For a large deployment, include expected series count, samples per second, and retention in your provisioning request.

Integrations

Does Sauron support OCI metrics querying and alerting

If the OCI Metrics plugin is available in this Sauron's Grafana, you can query OCI Monitoring metrics through a separately configured datasource. Check plugin availability and IAM access in OCI Metrics in Grafana; test a query before building an alert.

Does Sauron support ingesting data from AWS?

The documented HTTPS metrics and logs paths can be used from a service on AWS if its network and credentials can reach this Sauron. Start with Connect my service and prove one test event reaches Sauron. Ask the Sauron team to confirm support for your particular network path before rollout.

Does Sauron provide direct integration with Slack?

Yes. Configure and test an approved Slack alert receiver.

Can Sauron send my alerts directly to email i.e. Alertmanager/Grafana email integration?

Yes, with approved SMTP setup. Follow the email alert guide.

Can I trigger an alert based on logs in OpenSearch?

Yes, if OpenSearch Alerting is enabled for your instance. Follow log alert setup.

Are there any Sauron SDK/CLI available?

Sauron provides REST APIs rather than a separate SDK described here. Start with a read-only check in the API guide, then use this instance's Swagger page for the supported request shape.

Can Sauron Prometheus pull/federate metrics from dev boxes running inside Oracle network?

If Sauron cannot reach your metrics endpoint directly, an enabled PushProx client may bridge the connection. Check PushProx setup and confirm the target is up in Prometheus before relying on its metrics.

Does Sauron support RBAC for Grafana to control access for dashboards, etc?

Grafana access can be mapped to Admin, Editor, or Viewer entitlements. Check the role you need in User Access and request the matching OIM entitlement.

Where can I read more about exporters and beats

Now that I have my metrics and logs in Sauron, how do I configure my alerts?

Start with your first metrics alert.

Now that the endpoints are set up for my Sauron, how do I create data sources in Grafana?

Use the provisioned Prometheus datasource. See Grafana dashboards.

Security

Sauron endpoints support TLS and access controls. Oracle SSO is enabled by default for production endpoints; approved Basic Authentication and Bearer tokens support client tasks. Use User Access to check the method for your task, and ask the Sauron owner before changing an access setting.

Does Sauron support RBAC in addition to SSO integration?

Grafana provides a limited RBAC capability. Sauron endpoint access is covered by the SSO and OIM role guidance in the access pages.

How does Sauron handle security patching?

Ask the Sauron team for the current patching schedule and evidence for your instance. Patch timing depends on the component and the change being applied.

How do I get Oracle SSO access to my Sauron?

Oracle SSO is enabled by default for production endpoints. Ask your Sauron owner which OIM entitlement to request, then check your access.

I want to change HTTP basic authentication credentials for my Sauron. How do I do it?

The Sauron admin user password can be changed through the API server.

How do you ensure all software you run on your cluster free of known CVEs?

No software inventory can guarantee that every component is free of known vulnerabilities at every moment. For current scan, remediation, or audit evidence, provide the Sauron URL and the component in scope to the Sauron team.

Do you make the build from source images you use available to internal customers?

See Client-side Container Images. Confirm the approved version and permitted use with the Sauron team before deployment.

Architecture

Do you have a high level architecture overview?

See the architecture overview. Confirm the components enabled on your own instance in Console.

Is Sauron HA?

Sauron can use replicas and multiple availability domains for supported components, depending on the instance and region. This improves resilience but does not guarantee zero downtime. Ask the Sauron team for the actual topology and recovery expectations for your instance; single-AD regions have different limits.

How does Sauron handle upgrades?

  • Sauron runs on OCI OKE clusters. The team schedules Kubernetes and component upgrades according to platform requirements. An upgrade can affect endpoint availability, so use the communicated change window and status updates for your instance.
  • The Sauron team manages worker-node patching and component upgrades. Ask the team for the current maintenance schedule and change record for your instance.
  • For a software or image approval question, ask for the approval record that covers the exact component and version in your instance.

Does Sauron have Disaster Recovery support?

Recovery depends on the backups, region, and recovery procedure configured for your instance. Console Recovery shows available backup inventory; it does not prove a restore or cross-region recovery will work. Ask the Sauron team for the current recovery plan and tested recovery objectives before treating them as a service commitment.

Migration

Does the Sauron Team provide support for migration?

Export paths depend on the component. For logs, see Download OpenSearch Data; for dashboards, see Grafana dashboards. Ask the Sauron team to confirm migration support and the destination's capacity before moving a live workload.

All our metrics data is using InfluxDB in our self hosted cluster; do you support migration to Prometheus?

There is no Sauron guide for converting InfluxDB history into Prometheus samples. Keep the old datasource available for historical queries while you start sending new metrics through Sending Metrics. Confirm any temporary InfluxDB datasource and network access with your Grafana owner.

Troubleshooting and common support questions

Why am I getting SSO or OIM access denied for Grafana, Prometheus, Thanos, Alertmanager, API, Help, or Console?

Check the URL and your OIM entitlement, then follow the access-denied checks.

What CIDRs or IPs should I allowlist for Sauron, Shuttleproxy, OpenSearch, or Prometheus scraping?

Use this Sauron's current CIDRs from the API. See Sending Metrics and Shuttleproxy network rules.

Why does Shuttleproxy show 403, 504, DNS errors, registration failures, or no scrapeable targets?

Follow the Shuttleproxy checks.

Prometheus accepted my config update, but targets or metrics are missing. What should I check?

An accepted update does not prove a successful scrape. Follow the missing-target checks.

Why do Thanos or Grafana queries show no data, inconsistent data, or slow dashboards?

Compare the same query and time range using the dashboard checks.

Why are Thanos additional stores missing, denied, or not visible after a config change?

Follow the Thanos store checks.

How do I create or update Grafana dashboards through UI or API?

Follow Grafana dashboards, including its API reference if you need automation.

Why are logs missing in Kibana or OpenSearch, and can I use Filebeat or Logstash 8.x?

Follow the missing-log checks. Confirm your shipper's version with its owner before changing a production client.

What should I check for OpenSearch yellow/red health, unassigned shards, or restore requests?

Check the cluster and snapshot first in Restore OpenSearch Indices. Ask the Sauron team about large restores.

How do I configure Alertmanager Ocean webhooks, bearer tokens, or email alerts?

Follow the receiver procedures in Defining alerts.

Why do Grafana email alerts fail or hit delivery limits?

Follow the Grafana email checks.

How do I request Sauron decommission or termination?

Post the request in #sauron-support or open the agreed support ticket for your team. Include the full Sauron endpoint, region, owner contacts, reason for decommission, requested date, and whether metrics, logs, dashboards, alerts, or backups need to be preserved before termination.

Do not assume that a single Grafana or Kibana URL is enough to identify the full Sauron environment. Provide the Help or API endpoint when possible.

How do I request a retention change or preserve data after decommission?

Sauron has separate retention settings for online metrics, online logs, and backups. Increasing one of them can affect storage, query latency, backup usage, and restore expectations, so provide the requested component and reason before asking for a change.

For a metrics retention increase, include the Sauron URL, current retention, requested retention, expected ingestion volume, dashboard or query need, target date, and whether this is temporary or permanent.

For decommission or EOL cases, state whether metrics, logs, dashboards, alerts, or backups must remain available after the Sauron is terminated. If logs or metrics need to be kept beyond Sauron's configured backup retention, plan an export or ownership transfer before decommission starts.

Why does Basic Auth return 403, and where do I request credential resets?

Check the endpoint and account type in User Access. Ask your Sauron owner for a reset; never post credentials or reset links.

How do I find the Sauron component URLs for a new instance or region?

Use your welcome email or Console Endpoints.

What should I do if Prometheus rejects scrapes after content-type changes?

Check the target's response Content-Type and the error on Prometheus Targets. For compatible metrics with a missing or invalid header, an owner-approved fallback_scrape_protocol setting may help on supported Prometheus versions. Test it in a test Sauron using the scrape checks; an accepted upload does not prove the target works. See the Prometheus scrape configuration.

Why do API updates fail with Changes not allowed while Observability is locked?

The instance is locked, so most write operations return 409 Conflict. Check the maintenance or migration notice; do not keep retrying writes. If urgent work is blocked or no notice explains the lock, request a review using the support checklist. Include the attempted operation and exact error. Only the Sauron owner/team should decide whether the lock can be removed.

How should I configure dynamic scraping when a pod has multiple containers or ports?

Match the Service, ServiceMonitor, labels, namespace, port name, path, and TLS settings to the actual endpoint. For multiple containers or ports, use explicit service ports or separate scrape entries. Confirm the target in Prometheus using Sending Metrics.

How do I create Jira tickets from alerts or dashboard firing alerts?

Sauron no longer supports enabling new Jiralert integrations. Ask the Sauron owner to review any legacy configuration before relying on it. Use a supported receiver from Defining Alerts. For delivery failures, use the notification checks.

For a dashboard of firing alerts, first query ALERTS in the datasource you intend to use and confirm the required labels exist. If it is unavailable, inspect the alerting UI/API; agree on a supported dashboard datasource with your Sauron owner rather than assuming Alertmanager exposes that metric.

Can Sauron enable new Grafana or OpenSearch plugins?

New Grafana or OpenSearch plugins are platform changes. They require approval and review before they can be installed in Sauron.

For Grafana plugins, provide the plugin name, version, source URL, business need, environments that need it, and approval/ticket links. The plugin must go through PLS approval, Third Party approval, license review, and CVE/security review before rollout can be considered.

For OpenSearch plugins or Machine Learning features, provide the current Sauron OpenSearch version, requested feature, business need, and whether the request requires new plugins, new images, or an OCI OpenSearch migration path. Do not assume OCI OpenSearch feature availability maps directly to the current Sauron-managed OpenSearch runtime.

Where is encryption at rest covered for Sauron?

Sauron stores backups and other backup-related objects in OCI Object Storage. OCI Object Storage provides automated encryption in transit and at rest for that data.

Encryption details for live Sauron data depend on the component and data path in scope. When asking for audit or compliance evidence, identify which data path you need covered:

  • Prometheus metrics
  • Thanos object storage
  • OpenSearch logs
  • Grafana dashboards and configuration
  • Sauron backups
  • API or UI traffic

If you need a formal audit response, include the Sauron URL, region, component/data path, and the control question being asked. The Sauron team can then provide the current architecture or service-specific evidence for that scope.

What information is needed for an mTLS enablement request?

Sauron supports TLS-based integrations, including client-certificate authentication for applicable scrape or endpoint flows. mTLS changes affect how clients authenticate to a Sauron endpoint, so they should be planned and validated before production use.

For an mTLS enablement request, include:

  • Sauron URL
  • region
  • endpoint or component
  • certificate/CA owner
  • client identity expectations
  • rollout window
  • validation plan
  • rollback plan
  • approval or ticket link

Before production rollout, validate the certificate chain, client trust, endpoint routing, and non-production behavior.

What should I include before asking the Sauron team to restart, unlock, restore, patch, or delete something?

Restart, unlock, restore, patch, and delete requests can affect a live Sauron environment. Please include enough context for the Sauron team to validate the request and execute it safely:

  • Sauron URL
  • component
  • requested action
  • reason and evidence
  • production impact
  • rollback expectation
  • approval or ticket link

For restore requests, also include the exact indices, desired snapshot or backup time, target environment, whether this is partial or full restore, and the impact window.