#1190 - HITL Logs to Log Analytics

Introduction 

HITL is being used by lots of our customers, in conjunction with AI Agents.

Recently we released a dedicated OCI Log Analytics dashboard for monitoring your HITL driven workflows. We will delve into the dashboard later; let's start with the pre-requisites - how to get HITL logs to OCI Log Analytics. For that we need a log group, as target for the HITL logs. We also need a parser, which will interpret the log data. Some policies are required for this to function, but, once all is set up, we just need to activate the sending of logs. This we do in the OIC console page for your OIC instance. But let's begin with Log Analytics.

Parser in OCI Log Analytics

This is provided OOTB -

The parser requires a "source" log -

This is an example HITL log file, on which the parser is based.

Back in the parser - 

Here is the example log content - 

{

  "processDefinitionId": "UniqueProcessDefinitionID",

  "processDefinitionName": "UTProcess",

  "processDefinitionTitle": "UTProcess",

  "taskTitle": "User task 1",

  "processDefinitionKey": "OIC_PROJECT_1--01.00.0000--UTProcess",

  "startTime": "2026-05-25T10:49:00.188+00:00",

  "endTime": 1779708077902,

  "processInstanceState": "CREATED",

  "processInstanceId": "UniqueProcessInstanceID",

  "processDefinitionVersion": "01.00.0000",

  "processInstanceDuration": 1938110,

  "activityType": "userTask",

  "activityInstanceState": "COMPLETED",

  "activityInstanceSubState": "INITIATED",

  "activityInstanceDuration": 1936318,

  "activityInstanceId": "UniqueActivityInstanceID",

  "assigneeId": "beb0d855cf9040a3a0f16dUniqueID",

  "assigneeName": "beb0d855cf9040a3a0f16dUniqueID",

  "assigneeType": "USER",

  "activityId": "flow_UniqueActivityID",

  "activityName": "User task 1",

  "taskOutcome": "SUBMIT",

  "faultCode": "ABC123",

  "taskSubtype": "Submit",

  "taskId": "UniqueTaskID",

  "eventTimestamp": 1779708077902,

  "executionId": "UniqueExecutionID",

  "deploymentId": "UniqueDeploymentID",

  "oicProjectId": "OIC_PROJECT_1",

  "updatedTime": null,

  "inputPayload": null,

  "businessKey": "Leave Approval",

  "instanceIdentifier": "ut1",

  "userTaskOutputPayload": {

    "taskExec": {

      "approver": "beb0d855cf9040a3a0fUniqueID",

      "approverDisplayName": "user display name",

      "summary": "",

      "approvedDate": "2026-05-25T11:21:17.577Z",

      "approverComment": "null",

      "assignedDate": "2026-05-25T10:49:01.261Z"

    },

    "taskOutcome": "SUBMIT"

  },

  "outputPayload": null,

  "candidateUsersAndGroups": [

    {

      "name": "sample.user@example.com",

      "type": "USER"

    },

    {

      "name": "sample_group",

      "type": "GROUP"

    }

  ],

  "time": 1779708078285,

  "logGroupOCID": "ocid1.loganalyticsloggroup.oc1.phx.exampleuniqueid",

  "serviceInstanceOCID": "ocid1.processautomationinstance.oc1.phx.exampleuniqueid"

}

As you can see, it includes task name, approver, task outcome etc, as well as the OCID of the OPA service instance.

During the log ingestion process OIC will provide the target log group and the log source.

Create a new Log Group in Log Analytics

Then copy the ocid for future use.

Enable HITL for Log Analytics

This is simple - go to the OCI console page for your OIC instance.

Click Enable and paste the ocid of the log group you just created.

Apply Policy Permissions

Currently HITL runs as part of OPA (Oracle Process Automation). We need to allow this HITL (OPA) instance access to Log Analytics.

I have already enabled such for my OIC instances. I created a dynamic group and added the resource ids of my OIC instances.

This dynamic group will now be augmented with the HITL id. This id can be found in the OCI console for your OIC instance. The entry in the dynamic group should be in the following format -

ALL {resource.id = 'ocid1.processautomationinstance.oc1.phx.nnn'}

The dynamic group is used in a Policy - 

It takes a couple of minutes for the policy to kick in.

After a nice cup of English Breakfast tea - I run an OIC based agent that processes orders. The logic is simple; orders > $1000 need to be manually approved.

I run this a couple of times -

Then move to Log Explorer - 

Check out the HITL Logs - 

Here's the raw log data - 

HITL Dashboard

There is now a HITL dashboard in Log Analytics, let's check it out -

There my 2 tasks, back in the Task list - 

I've approved one of the tasks, let's refresh the dashboard - 

Looks good!

I have one active and one completed instance -

You can check out the queries behind each of the widgets - 

Here is the query - 'Log Source' = 'OCI Integration - HITL Activity Stream Logs' and 'Event Type' = PROCESS | rename 'Process State' as State | stats latest(State) as State by 'Process Name', Instance | stats count(Instance) as 'Instance Count' by State, 'Process Name' | where State not in (created)

Net, net - you can create your own widgets based on your own queries; you can also edit existing queries and save as a different widget.

One thing to note here - the Entity value from the filter is not used. Let's get rid of this, as it may cause confusion. To do this, I duplicate the HITL dashboard and edit the duplicate - 

The Entity is still referenced in the widgets, but we can simply remove it.

Don't enter a value, just click Save changes.

Data is now rendered in the widget - 

Do this for all the widgets - 

I open the original HITL dashboard, to check out the Tasks tab - 

There are 5 widgets - 

• Tasks by status
• Tasks by status and workflow
• Pending tasks by users/groups
• Completed tasks by approver
• Tasks by outcome

One thing to note, these tasks are at compartment level; so, if you have 3 OIC instances in your compartment, you could potentially see the aggregation of tasks. There is a serviceInstanceOCID field in the HITL log which can be used to filter on HITL/OPA instance. More about that in a follow-up post.

Summa Summarum

This is a very useful dashboard for those using HITL. It can be exposed to LOB folks easily and avoids having to give them access to OIC/OPA for HITL monitoring purposes.

 

#1189 - Apply least privileges to OIC File Server access

Introduction

This is a simple use case - User 1 needs to give a 3rd party access to a folder on OIC File Server.

User 1 is an OIC Admin and the 3rd party will use sFTP to push files to OIC File Server.

 

First step is the activate user 1 for File Server and generate keys - 

ssh-keygen -t ed25519 -C "OICTraining-FileServer"

Here's a screenshot - 

Here are the files created - 

I'll rename the one with type MSFT Publisher to OICTrainingFileServerPub as this is the public key.

Now to OIC File Server - upload the public key -

I create a folder, boscaIsteach (inbox in Gaelic)  in my home directory -

As already mentioned, I need to give a 3rd party access to this folder, so I create a user for this 3rd party in IAM.

In the real world, this user would also have its key pair - so I generate them - 

Back in OIC File Server - I locate this new user - 

Regarding permissions for it's home folder - 

I have to give at least one permission - so I go for List - and also click Do not inherit.

Back in my target folder -

I just give write permissions - 

Now open FileZilla - and add a new site - this is the 3rd party's ftp access to OIC File Server. 

Connect - 

I try to upload a file - 

Try uploading to  /home/users/niall.commiskey@oracle.com/boscaIsteach

File transfer was successful, but, note, I don't see a list of the files in this folder, as I don't have the list permission assigned.

I try to create a new sub-folder in /boscaIsteach -

That too is denied.

Net, net all I can do is upload files.

Naturally, one could create an IAM group, if you have multiple 3rd parties pushing files to OIC File Server. Then assign folder permissions to the group.