What it means
Log rotation and retention balance evidence needs, storage limits, privacy, performance, legal obligations, and reliable archival so important events remain available for the required period.
Why it matters
Retention that is too short destroys investigative value, while uncontrolled growth can impair the system being monitored; both risks require deliberate policy and testing.
Practical focus
- Define the log classes, retention periods, and evidence requirements for each system and the events that require attention
- Configure size and time rotation, protected archives, deletion controls, and capacity monitoring with consistent ownership and change records
- Validate retention compliance, rotation failures, file ownership, compression, and retrieval tests for coverage, integrity, and operational usefulness
- Rehearse runaway logging exhausting storage or rotation deleting evidence too soon so response steps do not depend on improvisation
Common mistakes
- Collecting signals without defining a response decision
- Assuming successful configuration means sustained coverage
- Keeping evidence on the same failure path as the protected service
- Waiting for runaway logging exhausting storage or rotation deleting evidence too soon before testing detection and recovery
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: