What Is Log Retention?

Last verified on Nov 8, 2026.

Log retention is how long you keep logs before deleting them. A log retention policy sets that period for each type of log, based on what you need for debugging, security investigations, and legal or contractual obligations. Keep too little and you cannot investigate an incident that surfaces late. Keep too much and you pay to store, and expose, data you no longer need.

Retention, Rotation, and Preservation

NIST SP 800-92 separates three ideas that are often mixed up:

Rotation is a file-level mechanism. See the logrotate guide for configuring it on a host. Retention is the policy applied to everything after that. NIST adds that organizations may need to keep copies longer than the original log sources can support, which is why archival processes exist, and that archived logs need their confidentiality and integrity protected.

What Sets the Number

OWASP's logging guidance is direct: log data, temporary debug logs, and backups or extracts must not be destroyed before the required retention period, and must not be kept beyond it. Legal, regulatory, and contractual obligations affect those periods. Two consequences follow:

• Retention is a ceiling as well as a floor. Old logs that hold personal data are a liability. See secrets in logs.
• The period belongs to the log type. Audit records for access changes, application errors, and debug output rarely share one answer. For payment environments, see PCI DSS logging requirements and read the standard itself for the current numbers.

NIST also lists storage choices per entry: not stored, stored on the system only, or stored both on the system and in the central log management infrastructure. Debug messages only the vendor can interpret are the kind of entry that generally does not need to be stored.

Examples of Built-In Retention

AWS CloudTrail shows two common shapes. Event history is a viewable, searchable, and immutable record of the past 90 days of management events in a Region, with no charge for viewing it. For longer needs, CloudTrail Lake event data stores can keep data for up to 3,653 days on the one-year extendable option, or up to 2,557 days on the seven-year option. See audit log for what those records contain.

A Short Policy Checklist

1. List your log types: application, access, security and audit, infrastructure, and debug.
2. Write the reason for each retention period next to it, whether legal, contractual, or operational.
3. Decide where each type lives. Recent data stays searchable in your log aggregation tool, and older data may move to cheaper archive storage.
4. Reduce volume before storage where you can. See log sampling.
5. Define who can place a preservation hold and who can delete.
6. Test a restore from the oldest tier before you need it.

Retention in Sazabi

Sazabi, an AI-native observability and security platform, stores logs, metrics, traces, and events in managed storage. Retention depends on your plan, and the pricing page lists what each plan includes. Records older than your plan's retention window are removed automatically during routine cleanup. Retention changes apply going forward, not retroactively.

Data also leaves in two other ways. Deleting a log stream stops future ingestion, but records already stored remain until they age out. Removing a project removes its stored data. Organizations on bring your own cloud keep their logs in a database account they own, still operated by Sazabi. Details are in the storage and retention docs, and what Sazabi watches in your log streams is a separate page.

Frequently Asked Questions

How long should I keep logs?

As long as your legal, regulatory, contractual, and operational needs require, and no longer. OWASP says logs must not be destroyed before the required period or kept beyond it. Start from the obligation for each log type, not one number for everything.

What is the difference between log retention and log rotation?

Rotation closes one log file and opens a new one on a schedule or size limit. Retention is how long the rotated and archived logs are kept before disposal.

What is log preservation?

NIST defines it as keeping logs that would normally be discarded because they record activity of particular interest, usually for an investigation or incident.

Do retention changes apply to old logs?

It depends on the system. In Sazabi, retention changes apply going forward, not retroactively, and records older than the plan window are removed during routine cleanup.

Sources

1. NIST defines log retention (archiving on a regular basis), log preservation (keeping logs that would be discarded), and log rotation; archival may be needed because log sources cannot hold logs long enough (accessed Nov 8, 2026)
2. Logs must not be destroyed before the required retention period and must not be kept beyond it; legal, regulatory, and contractual obligations affect the period (accessed Nov 8, 2026)
3. CloudTrail Event history keeps 90 days of management events; CloudTrail Lake event data stores can retain data for up to 3,653 days or 2,557 days depending on the pricing option (accessed Nov 8, 2026)
4. Sazabi retention depends on plan; records older than the window are removed automatically; retention changes apply going forward; deleting a log stream or a project (accessed Nov 8, 2026)