# Enable memory metrics for your OCI VMs

**For:** your OCI network or cloud administrator. **Time:** usually minutes per network, not per VM. **Changes on VMs:** none in the common case. No reboot, no install.

## Why this is needed

The migration assessment reads CPU, disk and network usage directly from OCI for every VM. **Memory is different:** only the operating system knows how much memory is really used. OCI gets it from the **Oracle Cloud Agent**, which is preinstalled on Oracle-provided images (Oracle Linux, Ubuntu, Windows and others). The agent must be able to **reach OCI services over the network** to send the data.

Without memory data, the assessment has to assume each VM needs all of its current memory, so VMs cannot be right-sized. Memory data only starts from the moment it's fixed: **the earlier, the better.**

Your assessment page (**Memory** section) lists which VMs lack memory data, **grouped by the network fix that applies**. Start there.

## Case 1: VMs in private subnets (most common)

Private subnets have no route to the internet. Give them a private route to OCI services **once per route table**. Every VM using that route table is fixed at the same time.

1. **Create a Service Gateway** (once per VCN, free): *Networking → Virtual cloud networks → your VCN → Service Gateways → Create Service Gateway*. Services: **All \<region\> Services in Oracle Services Network**.
2. **Add a route rule** to each route table listed on your assessment page: *VCN → Route Tables → table → Add Route Rules*. Target type **Service Gateway**, destination service **All \<region\> Services in Oracle Services Network**, target: the gateway from step 1.
   - If the subnet already routes `0.0.0.0/0` to a **NAT Gateway**, that also works and this step is not needed. Check the egress rules instead (step 3).
3. **Allow HTTPS egress**: the subnet's security list, or the VMs' network security groups, must allow egress TCP 443 to the same service (or to `0.0.0.0/0`). Default security lists already allow all egress.

Memory data appears within about 10 minutes. No change on the VMs. The assessment picks it up automatically at its next collection and both teams are notified; nothing else is needed.

## Case 2: VMs in a public subnet but without a public IP

The subnet routes to an **Internet Gateway**, but the VM has no public IP, so it can't use that route. OCI **does not allow** the "All services" Service Gateway route in a route table that also routes to an Internet Gateway, so step 2 above is not possible here. Choose one, per VM:

- **Add a public IP** to the VM (*Instance → Attached VNICs → VNIC → IPv4 Addresses → Edit → Ephemeral public IP*). Inbound access is still controlled by your security rules; allow only what you need. Or:
- **Move the VM to a private subnet** that has a Service Gateway or NAT route (for example by adding a secondary VNIC or recreating the VM there). More work; plan with the application owner.

## Case 3: Monitoring is turned off on the VM

*Compute → Instances → instance → Oracle Cloud Agent tab* → enable **Compute Instance Monitoring**. It takes effect within about 10 minutes. It's a per-VM toggle; for many VMs, your administrator can script it with the OCI CLI or Terraform.

## Case 4: the network is fine but still no data

Check that the agent is installed and running on the VM:

| OS | Check |
| --- | --- |
| Oracle Linux / CentOS | `sudo yum info oracle-cloud-agent` · `sudo systemctl status oracle-cloud-agent` |
| Ubuntu | `snap info oracle-cloud-agent` |
| Windows | Programs and Features → *Oracle Cloud Agent*, or the *OracleCloudAgent* service |

Images older than November 2018 (Ubuntu: February 2019) and some imported or custom images don't include the agent. Oracle documents how to install it; installing it is a change on the VM, so plan it with the VM owner.

## Already have memory history elsewhere?

If you use a monitoring tool (Zabbix, Datadog, Prometheus/Grafana, vROps, SCOM, Dynatrace…), one CSV export for all VMs, with columns `vm, timestamp, memory_used_pct`, gives the assessment your past history immediately. On Linux with sysstat, the assessment team can give you a read-only Ansible playbook that exports what `sar` already keeps, for the whole fleet into one file.

## What this does not do

None of these steps gives the assessment team any additional access. The agent sends memory metrics to **your own OCI Monitoring service**; the assessment reads them with the same read-only policy as CPU, disk and network.