Log Retention: How Long Should You Keep Security Logs?

Why does log retention matter?

Retention decides whether the evidence still exists when you need it. Data about an event may be needed weeks or months after it happened, and an investigation can only reconstruct what the logs still hold.

NIST SP 800-92 separates two activities. Log retention is archiving logs regularly as part of normal operations. Log preservation is keeping logs that would normally be discarded because they record activity of particular interest, for example during an incident or a legal hold. A good policy covers both.

• Investigations — tracing an attacker back to the first compromised account or host.
• Compliance — showing auditors that required events were recorded and kept.
• Evidence — supporting legal disputes, official requests and internal inquiries.
• Detection — giving baselines and correlation rules enough history to work with.

Keeping everything forever is not the answer either. Logs often contain personal data such as usernames and IP addresses, and the GDPR's storage limitation principle (Article 5(1)(e)) says personal data should be kept no longer than necessary for its purpose. A retention policy therefore needs a maximum as well as a minimum.

Write the policy down. For each log type, record the minimum and maximum period, the storage tier, who owns it and how deletion happens. Auditors usually ask to see the policy as well as the logs.

What are common regulatory log retention periods?

There is no universal number. PCI DSS requires at least 12 months of audit log history, CIS Controls set a 90-day minimum, and many other frameworks require logging without fixing a period.

Two details are easy to miss. PCI DSS has two tiers, a year of history but only three months immediately available, which maps neatly onto hot and archive storage. And the HIPAA six-year rule is often quoted as a log retention period, while the regulation applies it to required documentation.

Without a mandate, decide by risk. NIST SP 800-92 offers example values of one to two weeks for low-impact systems, one to three months for moderate and three to twelve months for high-impact systems, and stresses they are a starting point that ignores regulatory requirements.

What are hot, warm and cold log storage?

They are storage tiers that trade search speed for cost. Hot storage keeps recent logs instantly searchable, warm storage keeps older logs searchable on cheaper hardware, and cold storage keeps compressed archives for the long term.

Set periods per log type, not globally: authentication, firewall and admin activity logs usually deserve more time than verbose debug output. NIST SP 800-92 also advises choosing archive formats and media that will still be readable when the retention period ends.

Test the path back from cold storage. If a requirement says logs must be immediately available, a restore that takes days does not meet it, so measure how long it takes to bring an old month back into search.

In Logchase log management, recent logs stay in a searchable index and older data moves to compressed archives: a full-detail SIEM archive that can be restored into search, and a separate minimal archive for Law No. 5651.

How do you prove log integrity?

You prove integrity by showing that logs have not changed since they were collected. Hash each log file or batch, protect the hashes, and add a trusted timestamp that proves when the data existed.

1. Hash on collection or archiving. A cryptographic hash such as SHA-256 is a fingerprint of the file; any change produces a different value. NIST SP 800-92 recommends message digests to confirm that transferred logs were not altered.
2. Time-stamp the hash. An RFC 3161 time-stamping authority signs the hash with the time, providing evidence that the data existed in that form before that moment.
3. Restrict and log access. Limit who can read, export or delete archives, and record those actions too.
4. Keep copies apart. Store a replica in a separate location so one failed or compromised system cannot erase the evidence.
5. Verify regularly. Recompute hashes on a schedule and before handing logs to auditors or investigators.
6. Keep clocks in sync. Synchronize time on every log source so that event timestamps line up across systems.

Integrity matters most when logs become evidence. Attackers who gain administrative access often try to clear or alter logs (MITRE ATT&CK T1070, Indicator Removal), and timestamped hashes show whether that happened.

Logchase hashes archives and time-stamps them with RFC 3161, using TÜBİTAK Kamu SM Zamane or FreeTSA as the authority; Enterprise and Elite packages add disaster recovery replication. To collect logs in the first place, see our syslog server guide.