Home / Knowledge hub / Log retention
Knowledge hub
Log retention
How long you keep logs, which decides whether you can investigate old incidents.
What it means
Log retention is the length of time you keep logs before they are deleted or moved out of reach. It covers application logs, access logs, sign-in records and the audit trail of who changed what. The setting is usually a number of days, and it is often chosen by whoever set up the tool, not by anyone who thought about investigations.
The idea that makes it click: logs are evidence, and evidence has to still exist when you need it. Break-ins are often noticed long after they begin. If your logs roll over after a week, you can see what happened today but not how the intruder first got in.
Why it matters
Short retention turns a question you could answer into one you cannot. Which account was used first, which records were read, whether it started before the last release. Without the old logs, you cannot tell customers or regulators how far it went, so you may have to assume the worst.
Rules also set minimums. PCI DSS asks for audit log history of at least twelve months, with the most recent three months readily available. India's CERT-In directions ask for logs to be kept for a rolling 180 days. Keeping too much has a cost as well, because logs often hold personal data.
How it shows up
Retention is set in several places that nobody lists together: the application logger, the web server, the cloud provider's audit trail, the load balancer or CDN, and the log platform, which often has a short hot tier and a cheaper archive. Each can have its own default, and some defaults are short.
The repeating mistakes are logs kept only on the server that gets rebuilt, a cloud audit trail that was never switched on, and logs that the same administrators can edit or delete. Ask a plain question: could we say what a given account did ninety days ago? Then check that the answer comes from a record, not memory. See audit log.
Questions people ask
Log retention, answered
How long should we keep logs?
There is no single answer. Take the longest period that a rule, a contract or your own investigation needs, and write it down per log type.
PCI DSS names twelve months for in-scope audit logs. Many teams keep sign-in and access logs at least that long and drop noisy debug logs much sooner.
Is log retention the same as a backup?
No. A backup is a copy of data so you can restore it. Retention is how long the record of activity stays readable.
They can share storage, but a backup of your database will not tell you who read a record last March.
Can we keep logs forever?
You can, but you should not do so by default. Logs often contain email addresses, IP addresses and identifiers, and privacy law expects personal data to be kept no longer than the purpose needs.
Set a period, archive what you need to prove, and delete the rest on a schedule.
Where do old logs go when retention ends?
They are deleted, or in some setups moved to cheaper archive storage where search is slow but the record survives. Check which one your tool does, because the two look the same on a settings page.
Archived logs still need access control and should be protected from editing.
Does longer retention make an app safer?
Not by itself. It makes investigation and proof possible after the fact. It does nothing to stop a flaw being used.
Pair it with alerting, so someone reads the logs while the event is happening, not only after.
Sources
Where this comes from
Related
Terms that sit next to this one
Audit log
A record of who did what and when, kept so you can answer later.
Logging and monitoring
Recording what happens, and actually watching what gets recorded.
SIEM
A system that gathers logs from everywhere and raises alerts on suspicious patterns.
Digital forensics
Collecting and studying evidence from systems to learn what happened.
CERT-In directions
Indian rules requiring certain incidents to be reported within six hours.
Could you reconstruct last quarter?
Cyberlop findings come with the request, the response and a screenshot, so you have evidence of what happened that does not depend on old logs. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.