MQL expressions in OCI Monitoring retrieve and process metric data. Optional components include:
Statistic (B): Specifies how to summarize data (e.g., avg, max). If omitted, raw data is returned.
Grouping Function (D): Aggregates data across metric streams (e.g., by resourceId). It's optional if no grouping is needed.
Why not A, C, E, or F?
Interval (A): Defines the time window; defaults apply if omitted, but it's typically required for meaningful queries.
Previous (C): Not a standard MQL component (possibly a typo).
Metric (E): Mandatory to specify what's being queried.
Dimensions (F): Filters data; required if specific streams are targeted, though optional in basic queries.
Statistic and Grouping Function enhance flexibility but aren't mandatory.

To investigate user activity and REST API calls over the last six hours, the OCI Audit service is the appropriate tool.
Audit (E): This service automatically records all API operations (including REST API calls) performed on OCI resources. It provides detailed logs with user details, timestamps, and actions, ideal for security and compliance investigations. You can filter audit logs by time range (e.g., last six hours) and user attributes.
Why not A, B, C, or D?
Notifications (A): Sends alerts but doesn't store or analyze API call details.
Service Connectors (B): Moves data between services, not for auditing.
Management Agent (C): Collects metrics/logs from resources, not API audit data.
Logging (D): Handles application and system logs, not API activity tracking.
Audit logs are retained for 90 days by default, making this a perfect fit.

SQL Warehouse in Operations Insights categorizes SQL performance:
Degraded (A): SQL statements with declining performance over time (e.g., increased latency), indicating potential issues.
Plan changes (C): SQL statements with altered execution plans, impacting performance or resource use.
Why not B or D?
Climbing (B): Not a standard category; possibly a misnomer.
Efficient (D): Positive performance isn't a focus category.
These help identify and resolve SQL issues.

Creating an alarm query in OCI Monitoring involves MQL:
Invalid: You must specify a resource group (D): Resource groups (e.g., groupBy(resourceId)) are optional for aggregating metrics across streams; alarms can function without them.
Why A, B, and C are valid:
A: A statistic (e.g., max, avg) is required to process metric data.
B: An interval (e.g., [1m]) defines the time window, mandatory for evaluation.
C: A metric (e.g., CpuUtilization) is the core of the query.
Resource groups enhance, but aren't required for, alarms.

OCI Application Performance Monitoring (APM) provides tools to monitor application performance:
Distributed Tracing (A): Tracks requests across microservices, showing latency and dependencies via traces and spans.
Real User Monitoring (C): Captures real user interactions with web applications (e.g., page load times) using a Browser Agent.
Why not B or D?
Capacity Planning (B): Available in Operations Insights, not APM.
Java Management (D): Not a feature of APM; Java Agent is a tool, not a feature.
These features align with APM's focus on performance and user experience.