You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1. Changed the title a bit to “Data retention and archive in Azure Monitor Logs”
2. Removed the word “policies” that has a specific meaning in Azure
3. Rewrote the intro paragraph to indicate coming 12 years archive
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/data-retention-archive.md
+31-25Lines changed: 31 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,25 +1,23 @@
1
1
---
2
-
title: Configure data retention and archive in Azure Monitor Logs
2
+
title: Data retention and archive in Azure Monitor Logs
3
3
description: Configure archive settings for a table in a Log Analytics workspace in Azure Monitor.
4
4
ms.reviewer: adi.biran
5
5
ms.topic: conceptual
6
6
ms.date: 6/28/2023
7
7
# Customer intent: As an Azure account administrator, I want to set data retention and archive policies to save retention costs.
8
8
---
9
9
10
-
# Configure data retention and archive policies in Azure Monitor Logs
10
+
# Data retention and archive in Azure Monitor Logs
11
11
12
-
Retention policies define when to remove or archive data in a [Log Analytics workspace](log-analytics-workspace-overview.md). Archiving lets you keep older, less used data in your workspace at a reduced cost.
12
+
Data is retained in Azure Monitor Logs in two modes:
13
+
***Interactive Retention**: Allow you to retain Analytics logs for [interactive queries](../logs/get-started-queries.md) of up to 2 years.
14
+
***Archive**: Let you keep older, less used data in your workspace at a reduced cost. Data in archive can be accessed by [Search Jobs](../logs/search-jobs.md) and [Restore](../logs/restore.md). You can keep in Archive logs up to 7 years. In the coming months, it would be possible to extend archive to 12 years.
13
15
14
16
This article describes how to configure data retention and archiving.
15
17
16
-
## Permissions
17
-
18
-
To configure set data retention and archiving, you must have at least [contributor rights](../logs/manage-access.md#azure-rbac).
19
-
20
18
## How retention and archiving work
21
19
22
-
Each workspace has a default retention policy that's applied to all tables. You can set a different retention policy on individual tables.
20
+
Each workspace has a default retention that's applied to all tables. You can set a different retention setting on individual tables.
23
21
24
22
:::image type="content" source="media/data-retention-configure/retention-archive.png" alt-text="Diagram that shows an overview of data retention and archive periods.":::
25
23
@@ -32,19 +30,23 @@ You can access archived data by [running a search job](search-jobs.md) or [resto
32
30
> [!NOTE]
33
31
> The archive period can only be set at the table level, not at the workspace level.
34
32
33
+
## Permissions
34
+
35
+
To configure set data retention and archiving, you must have at least [contributor rights](../logs/manage-access.md#azure-rbac).
36
+
35
37
### Adjustments to retention and archive settings
36
38
37
-
When you shorten an existing retention policy, Azure Monitor waits 30 days before removing the data, so you can revert the change and prevent data loss in the event of an error in configuration. You can [purge data](#purge-retained-data) immediately when required.
39
+
When you shorten an existing retention setting, Azure Monitor waits 30 days before removing the data, so you can revert the change and prevent data loss in the event of an error in configuration. You can [purge data](#purge-retained-data) immediately when required.
38
40
39
-
When you increase the retention policy, the new retention period applies to all data that's already been ingested into the table and hasn't yet been purged or removed.
41
+
When you increase the retention setting, the new retention period applies to all data that's already been ingested into the table and hasn't yet been purged or removed.
40
42
41
-
If you change the archive settings on a table with existing data, the relevant data in the table is also affected immediately. For example, you might have an existing table with 180 days of interactive retention and no archive period. You decide to change the retention policy to 90 days of interactive retention without changing the total retention period of 180 days. Log Analytics immediately archives any data that's older than 90 days and none of the data is deleted.
43
+
If you change the archive settings on a table with existing data, the relevant data in the table is also affected immediately. For example, you might have an existing table with 180 days of interactive retention and no archive period. You decide to change the retention setting to 90 days of interactive retention without changing the total retention period of 180 days. Log Analytics immediately archives any data that's older than 90 days and none of the data is deleted.
42
44
43
-
## Configure the default workspace retention policy
45
+
## Configure the default workspace retention
44
46
45
-
You can set the workspace default retention policy in the Azure portal to 30, 31, 60, 90, 120, 180, 270, 365, 550, and 730 days. You can set a different policy for specific tables by [configuring the retention and archive policy at the table level](#set-retention-and-archive-policy-by-table). If you're on the *free* tier, you'll need to upgrade to the paid tier to change the data retention period.
47
+
You can set the workspace default retention in the Azure portal to 30, 31, 60, 90, 120, 180, 270, 365, 550, and 730 days. You can set a different for specific tables by [configuring the retention and archive policy at the table level](#set-retention-and-archive-policy-by-table). If you're on the *free* tier, you'll need to upgrade to the paid tier to change the data retention period.
46
48
47
-
To set the default workspace retention policy:
49
+
To set the default workspace retention:
48
50
49
51
1. From the **Log Analytics workspaces** menu in the Azure portal, select your workspace.
50
52
1. Select **Usage and estimated costs** in the left pane.
@@ -54,9 +56,9 @@ To set the default workspace retention policy:
54
56
55
57
1. Move the slider to increase or decrease the number of days, and then select **OK**.
56
58
57
-
## Set retention and archive policy by table
59
+
## Set retention and archive by table
58
60
59
-
By default, all tables in your workspace inherit the workspace's interactive retention setting and have no archive policy. You can modify the retention and archive policies of individual tables, except for workspaces in the legacy Free Trial pricing tier.
61
+
By default, all tables in your workspace inherit the workspace's interactive retention setting and have no archive. You can modify the retention and archive settings of individual tables, except for workspaces in the legacy Free Trial pricing tier.
60
62
61
63
The Analytics log data plan includes 30 days of interactive retention. You can increase the interactive retention period to up to 730 days at an [additional cost](https://azure.microsoft.com/pricing/details/monitor/). If needed, you can reduce the interactive retention period to as low as four days using the API or CLI, however, since 30 days are included in the ingestion price, lowering the retention period below 30 days does not reduce costs. You can set the archive period to a total retention time of up to 2,556 days (seven years).
62
64
@@ -101,6 +103,10 @@ The request body includes the values in the following table.
101
103
|properties.retentionInDays | integer | The table's data retention in days. This value can be between 4 and 730. <br/>Setting this property to null will default to the workspace retention. For a Basic Logs table, the value is always 8. |
102
104
|properties.totalRetentionInDays | integer | The table's total data retention including archive period. This value can be between 4 and 730; or 1095, 1460, 1826, 2191, or 2556. Set this property to null if you don't want to archive data. |
103
105
106
+
> [!NOTE]
107
+
> In the coming months, additional settings will be available to allow retention of up to 12 years.
108
+
109
+
104
110
**Example**
105
111
106
112
This example sets the table's interactive retention to the workspace default of 30 days, and the total retention to two years, which means that the archive duration is 23 months.
@@ -174,7 +180,7 @@ Update-AzOperationalInsightsTable -ResourceGroupName ContosoRG -WorkspaceName Co
174
180
175
181
---
176
182
177
-
## Get retention and archive policy by table
183
+
## Get retention and archive settings by table
178
184
179
185
# [Portal](#tab/portal-2)
180
186
@@ -187,13 +193,13 @@ The **Tables** screen shows the interactive retention and archive period for all
187
193
188
194
# [API](#tab/api-2)
189
195
190
-
To get the retention policy of a particular table (in this example, `SecurityEvent`), call the **Tables - Get** API:
196
+
To get the retention setting of a particular table (in this example, `SecurityEvent`), call the **Tables - Get** API:
191
197
192
198
```JSON
193
199
GET /subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/MyResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/MyWorkspaceName/Tables/SecurityEvent?api-version=2021-12-01-preview
194
200
```
195
201
196
-
To get all table-level retention policies in your workspace, don't set a table name.
202
+
To get all table-level retention settings in your workspace, don't set a table name.
197
203
198
204
For example:
199
205
@@ -203,7 +209,7 @@ GET /subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/MyResource
203
209
204
210
# [CLI](#tab/cli-2)
205
211
206
-
To get the retention policy of a particular table, run the [az monitor log-analytics workspace table show](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-show) command.
212
+
To get the retention setting of a particular table, run the [az monitor log-analytics workspace table show](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-show) command.
207
213
208
214
For example:
209
215
@@ -213,7 +219,7 @@ az monitor log-analytics workspace table show --subscription ContosoSID --resour
213
219
214
220
# [PowerShell](#tab/PowerShell-2)
215
221
216
-
To get the retention policy of a particular table, run the [Get-AzOperationalInsightsTable](/powershell/module/az.operationalinsights/get-azoperationalinsightstable) cmdlet.
222
+
To get the retention setting of a particular table, run the [Get-AzOperationalInsightsTable](/powershell/module/az.operationalinsights/get-azoperationalinsightstable) cmdlet.
217
223
218
224
For example:
219
225
@@ -225,19 +231,19 @@ Get-AzOperationalInsightsTable -ResourceGroupName ContosoRG -WorkspaceName Conto
225
231
226
232
## Purge retained data
227
233
228
-
If you set the data retention policy to 30 days, you can purge older data immediately by using the `immediatePurgeDataOn30Days` parameter in Azure Resource Manager. The purge functionality is useful when you need to remove personal data immediately. The immediate purge functionality isn't available through the Azure portal.
234
+
If you set the data retention to 30 days, you can purge older data immediately by using the `immediatePurgeDataOn30Days` parameter in Azure Resource Manager. The purge functionality is useful when you need to remove personal data immediately. The immediate purge functionality isn't available through the Azure portal.
229
235
230
-
Workspaces with a 30-day retention policy might keep data for 31 days if you don't set the `immediatePurgeDataOn30Days` parameter.
236
+
Workspaces with a 30-day retention might keep data for 31 days if you don't set the `immediatePurgeDataOn30Days` parameter.
231
237
232
238
You can also purge data from a workspace by using the [purge feature](personal-data-mgmt.md#exporting-and-deleting-personal-data), which removes personal data. You can't purge data from archived logs.
233
239
234
240
The Log Analytics [Purge API](/rest/api/loganalytics/workspacepurge/purge) doesn't affect retention billing. To lower retention costs, *decrease the retention period for the workspace or for specific tables*.
235
241
236
-
## Tables with unique retention policies
242
+
## Tables with unique retention periods
237
243
238
244
By default, two data types, `Usage` and `AzureActivity`, keep data for at least 90 days at no charge. When you increase the workspace retention to more than 90 days, you also increase the retention of these data types. These tables are also free from data ingestion charges.
239
245
240
-
Tables related to Application Insights resources also keep data for 90 days at no charge. You can adjust the retention policy of each of these tables individually:
246
+
Tables related to Application Insights resources also keep data for 90 days at no charge. You can adjust the retention of each of these tables individually:
0 commit comments