Plan log retention in tiers. Keep recent logs in fast, searchable storage for day to day investigation, move older logs to cheaper storage that is slower to query, and archive the long tail where you can still retrieve it. Set each period from your obligations and your detection delay, not from habit.
Why one retention number fails
A single setting such as "30 days everywhere" is wrong in both directions. It is too short for the investigation that starts after a customer complains in month three, and too long and expensive for noisy debug output nobody reads after a week.
The OWASP Logging Cheat Sheet states the two-sided rule: logs must not be destroyed before the required retention period ends, and must not be kept beyond it. Legal, regulatory and contractual obligations may set the period.
The three tiers
Hot. Indexed and fast. Used for live triage, dashboards and alert rules. Keep it small and recent. Days to a few weeks is typical, set by how quickly your team investigates.
Warm. Still searchable but on cheaper storage or with fewer indexes. Used for investigations that start late. A few months is common.
Cold or archive. Compressed objects in low-cost storage, retrieved on demand and sometimes re-indexed. Used for forensics, audits and legal holds. Retrieval takes minutes or hours, which is acceptable for the use.
Setting the periods
Work through four inputs.
- Obligations. Contracts, regulations and frameworks may name periods. Example: under 45 CFR 164.316(b)(2)(i), HIPAA security rule documentation must be retained for 6 years. That rule is about documentation, so ask whether it covers a given log type for your organization before applying it. See our note on the HIPAA six year rule.
- Detection delay. If breaches in your environment tend to be found weeks after the fact, you need logs that reach back past that gap. Long intrusions need long memory, as in log retention for long-running intrusions.
- Source value. Authentication, admin actions and cloud audit trails are worth keeping long. Verbose debug and health checks are not.
- Cost. Price each tier per gigabyte per month with your own numbers. We do not quote prices here because they vary by provider and change.
A starting table to adapt
- Authentication and admin actions: hot: Short; warm: Medium; archive: Long
- Cloud audit trails: hot: Short; warm: Medium; archive: Long
- Application security events: hot: Short; warm: Medium; archive: Long
- Web access logs: hot: Short; warm: Short; archive: Medium
- Debug and health checks: hot: Very short; warm: None; archive: None
Replace the words with durations your counsel and security lead agree on.
Keep deletion honest
Deletion is a control too. Automate expiry so data does not linger by accident, apply holds for legal matters, and log the deletion jobs. Personal data in logs adds a reason to expire sooner, which we cover in minimizing personal data in logs.
Test the archive
Once a quarter, retrieve a random day from the oldest tier and run a real query. Archives that cannot be read are not archives.
Quick check
Do cold logs need the same access controls as hot logs?
Yes. Archives hold the same sensitive events. Often they deserve stricter access and deletion protection.
Should I compress and archive everything forever?
No. Keeping data longer than needed raises cost and exposure, and may conflict with privacy obligations.
Sources
Last reviewed: 19 October 2026.
