Explanation
Retrieving Audit events
In order to make use of audit events, the first step is to retrieve and store audit events. Let's take a look into the ways in which an Audit event can be retrieved:
Oracle Cloud Infrastructure Web Console - With user credentials, customers can log in to the web console to access the Audit service. For example, when customers are trying the service for the first time; this helps with a first look into a handful of events.
Oracle Cloud Infrastructure CLI [3] - With CLI customers can make use of the service to retrieve events for a defined compartment and for a region specified as per CLI's config. The CLI command would look like:
#oci audit event list --start-time $start-time --end-time $end-time --compartment-id $compartment-id Oracle Cloud Infrastructure SDKs [4][5] - With SDKs customers can choose a supported language and retrieve Audit events with the ListEvents API [6]. For production use cases, this would be the best suitable option.
https://blogs.oracle.com/cloud-infrastructure/operating-oracle-cloud-infrastructure-tenancies-retrieving-audit-log