Audit log retention

Description

Audit log retention is the unglamorous infrastructure piece that turns "we have logging" into evidence usable by a regulator, auditor, or litigator months or years after the fact. Most modern privacy, security, and sectoral regulations require some form of audit logging covering user-data access (who looked at what), administrative actions (who changed what), security events (auth failures, privilege escalations, anomalous queries), and material business operations. Retention periods vary by source: SOX retention sits at seven years for relevant logs, HIPAA at six, GDPR breach-investigation logs at the lifetime of the underlying processing plus a residual window, PCI DSS at one year online plus three months immediately retrievable, and most sectoral regulators have their own table. The architecturally load-bearing fact is the immutability requirement: a log that the actor whose actions were logged could later edit is not, in regulator terms, an audit log at all. Implementation typically involves write-once or append-only storage (cloud object storage with object-lock, or a dedicated SIEM with tamper-evident hashing), with chain-of-custody documentation for any export to an investigator. What goes wrong in practice is retention-period drift; a log that was supposed to be kept for seven years but rotated out at one will surface only when someone actually goes looking.

Fulfilled by (3)

• datadog · partial · low effort · $$
• splunk · full · medium effort · $$$
• In-house build · medium effort

ClearLaunch does not accept payment from vendors. Methodology.

Evidence formats

• log-retention policy
• log-storage configuration
• tamper-evidence design notes