Skip to content

Commit 582d802

Browse files
authored
Update data-retention-archive.md
1. Changed the title a bit to “Data retention and archive in Azure Monitor Logs” 2. Removed the word “policies” that has a specific meaning in Azure 3. Rewrote the intro paragraph to indicate coming 12 years archive
1 parent 7a403b3 commit 582d802

File tree

1 file changed

+31
-25
lines changed

1 file changed

+31
-25
lines changed

articles/azure-monitor/logs/data-retention-archive.md

Lines changed: 31 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,23 @@
11
---
2-
title: Configure data retention and archive in Azure Monitor Logs
2+
title: Data retention and archive in Azure Monitor Logs
33
description: Configure archive settings for a table in a Log Analytics workspace in Azure Monitor.
44
ms.reviewer: adi.biran
55
ms.topic: conceptual
66
ms.date: 6/28/2023
77
# Customer intent: As an Azure account administrator, I want to set data retention and archive policies to save retention costs.
88
---
99

10-
# Configure data retention and archive policies in Azure Monitor Logs
10+
# Data retention and archive in Azure Monitor Logs
1111

12-
Retention policies define when to remove or archive data in a [Log Analytics workspace](log-analytics-workspace-overview.md). Archiving lets you keep older, less used data in your workspace at a reduced cost.
12+
Data is retained in Azure Monitor Logs in two modes:
13+
* **Interactive Retention**: Allow you to retain Analytics logs for [interactive queries](../logs/get-started-queries.md) of up to 2 years.
14+
* **Archive**: Let you keep older, less used data in your workspace at a reduced cost. Data in archive can be accessed by [Search Jobs](../logs/search-jobs.md) and [Restore](../logs/restore.md). You can keep in Archive logs up to 7 years. In the coming months, it would be possible to extend archive to 12 years.
1315

1416
This article describes how to configure data retention and archiving.
1517

16-
## Permissions
17-
18-
To configure set data retention and archiving, you must have at least [contributor rights](../logs/manage-access.md#azure-rbac).
19-
2018
## How retention and archiving work
2119

22-
Each workspace has a default retention policy that's applied to all tables. You can set a different retention policy on individual tables.
20+
Each workspace has a default retention that's applied to all tables. You can set a different retention setting on individual tables.
2321

2422
:::image type="content" source="media/data-retention-configure/retention-archive.png" alt-text="Diagram that shows an overview of data retention and archive periods.":::
2523

@@ -32,19 +30,23 @@ You can access archived data by [running a search job](search-jobs.md) or [resto
3230
> [!NOTE]
3331
> The archive period can only be set at the table level, not at the workspace level.
3432
33+
## Permissions
34+
35+
To configure set data retention and archiving, you must have at least [contributor rights](../logs/manage-access.md#azure-rbac).
36+
3537
### Adjustments to retention and archive settings
3638

37-
When you shorten an existing retention policy, Azure Monitor waits 30 days before removing the data, so you can revert the change and prevent data loss in the event of an error in configuration. You can [purge data](#purge-retained-data) immediately when required.
39+
When you shorten an existing retention setting, Azure Monitor waits 30 days before removing the data, so you can revert the change and prevent data loss in the event of an error in configuration. You can [purge data](#purge-retained-data) immediately when required.
3840

39-
When you increase the retention policy, the new retention period applies to all data that's already been ingested into the table and hasn't yet been purged or removed.
41+
When you increase the retention setting, the new retention period applies to all data that's already been ingested into the table and hasn't yet been purged or removed.
4042

41-
If you change the archive settings on a table with existing data, the relevant data in the table is also affected immediately. For example, you might have an existing table with 180 days of interactive retention and no archive period. You decide to change the retention policy to 90 days of interactive retention without changing the total retention period of 180 days. Log Analytics immediately archives any data that's older than 90 days and none of the data is deleted.
43+
If you change the archive settings on a table with existing data, the relevant data in the table is also affected immediately. For example, you might have an existing table with 180 days of interactive retention and no archive period. You decide to change the retention setting to 90 days of interactive retention without changing the total retention period of 180 days. Log Analytics immediately archives any data that's older than 90 days and none of the data is deleted.
4244

43-
## Configure the default workspace retention policy
45+
## Configure the default workspace retention
4446

45-
You can set the workspace default retention policy in the Azure portal to 30, 31, 60, 90, 120, 180, 270, 365, 550, and 730 days. You can set a different policy for specific tables by [configuring the retention and archive policy at the table level](#set-retention-and-archive-policy-by-table). If you're on the *free* tier, you'll need to upgrade to the paid tier to change the data retention period.
47+
You can set the workspace default retention in the Azure portal to 30, 31, 60, 90, 120, 180, 270, 365, 550, and 730 days. You can set a different for specific tables by [configuring the retention and archive policy at the table level](#set-retention-and-archive-policy-by-table). If you're on the *free* tier, you'll need to upgrade to the paid tier to change the data retention period.
4648

47-
To set the default workspace retention policy:
49+
To set the default workspace retention:
4850

4951
1. From the **Log Analytics workspaces** menu in the Azure portal, select your workspace.
5052
1. Select **Usage and estimated costs** in the left pane.
@@ -54,9 +56,9 @@ To set the default workspace retention policy:
5456

5557
1. Move the slider to increase or decrease the number of days, and then select **OK**.
5658

57-
## Set retention and archive policy by table
59+
## Set retention and archive by table
5860

59-
By default, all tables in your workspace inherit the workspace's interactive retention setting and have no archive policy. You can modify the retention and archive policies of individual tables, except for workspaces in the legacy Free Trial pricing tier.
61+
By default, all tables in your workspace inherit the workspace's interactive retention setting and have no archive. You can modify the retention and archive settings of individual tables, except for workspaces in the legacy Free Trial pricing tier.
6062

6163
The Analytics log data plan includes 30 days of interactive retention. You can increase the interactive retention period to up to 730 days at an [additional cost](https://azure.microsoft.com/pricing/details/monitor/). If needed, you can reduce the interactive retention period to as low as four days using the API or CLI, however, since 30 days are included in the ingestion price, lowering the retention period below 30 days does not reduce costs. You can set the archive period to a total retention time of up to 2,556 days (seven years).
6264

@@ -101,6 +103,10 @@ The request body includes the values in the following table.
101103
|properties.retentionInDays | integer | The table's data retention in days. This value can be between 4 and 730. <br/>Setting this property to null will default to the workspace retention. For a Basic Logs table, the value is always 8. |
102104
|properties.totalRetentionInDays | integer | The table's total data retention including archive period. This value can be between 4 and 730; or 1095, 1460, 1826, 2191, or 2556. Set this property to null if you don't want to archive data. |
103105

106+
> [!NOTE]
107+
> In the coming months, additional settings will be available to allow retention of up to 12 years.
108+
109+
104110
**Example**
105111

106112
This example sets the table's interactive retention to the workspace default of 30 days, and the total retention to two years, which means that the archive duration is 23 months.
@@ -174,7 +180,7 @@ Update-AzOperationalInsightsTable -ResourceGroupName ContosoRG -WorkspaceName Co
174180

175181
---
176182

177-
## Get retention and archive policy by table
183+
## Get retention and archive settings by table
178184

179185
# [Portal](#tab/portal-2)
180186

@@ -187,13 +193,13 @@ The **Tables** screen shows the interactive retention and archive period for all
187193

188194
# [API](#tab/api-2)
189195

190-
To get the retention policy of a particular table (in this example, `SecurityEvent`), call the **Tables - Get** API:
196+
To get the retention setting of a particular table (in this example, `SecurityEvent`), call the **Tables - Get** API:
191197

192198
```JSON
193199
GET /subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/MyResourceGroupName/providers/Microsoft.OperationalInsights/workspaces/MyWorkspaceName/Tables/SecurityEvent?api-version=2021-12-01-preview
194200
```
195201

196-
To get all table-level retention policies in your workspace, don't set a table name.
202+
To get all table-level retention settings in your workspace, don't set a table name.
197203

198204
For example:
199205

@@ -203,7 +209,7 @@ GET /subscriptions/00000000-0000-0000-0000-00000000000/resourceGroups/MyResource
203209

204210
# [CLI](#tab/cli-2)
205211

206-
To get the retention policy of a particular table, run the [az monitor log-analytics workspace table show](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-show) command.
212+
To get the retention setting of a particular table, run the [az monitor log-analytics workspace table show](/cli/azure/monitor/log-analytics/workspace/table#az-monitor-log-analytics-workspace-table-show) command.
207213

208214
For example:
209215

@@ -213,7 +219,7 @@ az monitor log-analytics workspace table show --subscription ContosoSID --resour
213219

214220
# [PowerShell](#tab/PowerShell-2)
215221

216-
To get the retention policy of a particular table, run the [Get-AzOperationalInsightsTable](/powershell/module/az.operationalinsights/get-azoperationalinsightstable) cmdlet.
222+
To get the retention setting of a particular table, run the [Get-AzOperationalInsightsTable](/powershell/module/az.operationalinsights/get-azoperationalinsightstable) cmdlet.
217223

218224
For example:
219225

@@ -225,19 +231,19 @@ Get-AzOperationalInsightsTable -ResourceGroupName ContosoRG -WorkspaceName Conto
225231

226232
## Purge retained data
227233

228-
If you set the data retention policy to 30 days, you can purge older data immediately by using the `immediatePurgeDataOn30Days` parameter in Azure Resource Manager. The purge functionality is useful when you need to remove personal data immediately. The immediate purge functionality isn't available through the Azure portal.
234+
If you set the data retention to 30 days, you can purge older data immediately by using the `immediatePurgeDataOn30Days` parameter in Azure Resource Manager. The purge functionality is useful when you need to remove personal data immediately. The immediate purge functionality isn't available through the Azure portal.
229235

230-
Workspaces with a 30-day retention policy might keep data for 31 days if you don't set the `immediatePurgeDataOn30Days` parameter.
236+
Workspaces with a 30-day retention might keep data for 31 days if you don't set the `immediatePurgeDataOn30Days` parameter.
231237

232238
You can also purge data from a workspace by using the [purge feature](personal-data-mgmt.md#exporting-and-deleting-personal-data), which removes personal data. You can't purge data from archived logs.
233239

234240
The Log Analytics [Purge API](/rest/api/loganalytics/workspacepurge/purge) doesn't affect retention billing. To lower retention costs, *decrease the retention period for the workspace or for specific tables*.
235241

236-
## Tables with unique retention policies
242+
## Tables with unique retention periods
237243

238244
By default, two data types, `Usage` and `AzureActivity`, keep data for at least 90 days at no charge. When you increase the workspace retention to more than 90 days, you also increase the retention of these data types. These tables are also free from data ingestion charges.
239245

240-
Tables related to Application Insights resources also keep data for 90 days at no charge. You can adjust the retention policy of each of these tables individually:
246+
Tables related to Application Insights resources also keep data for 90 days at no charge. You can adjust the retention of each of these tables individually:
241247

242248
- `AppAvailabilityResults`
243249
- `AppBrowserTimings`

0 commit comments

Comments
 (0)