Retention is where good intentions meet a spinning disk. Auditors want years, budgets want months, and the truth is that both are arguing about a number you can choose calmly, if you understand what the number actually controls.
In EventLog Analyzer, retention decides two things: how long logs stay in the fast, searchable index, and how long they survive afterwards as compressed archives that can be loaded back for investigation. Those are different promises with different prices. This page separates them, and gives you an honest way to pick both numbers without pretending one size fits every office.
When you set retention to a year, you are promising three people something: the auditor, that evidence will exist; the investigator, that last quarter's incident can still be reconstructed; and the storage budget, that a year of your network's events actually fits. Break any leg and the setting was fiction.
That is why retention gets decided in a short meeting, not alone at a console. Compliance, whoever investigates incidents, and whoever pays for disks all own a piece of the number.
Recent logs belong in the live index, where searches return in seconds and dashboards stay current. Older logs cost the same disk there but get touched rarely, so EventLog Analyzer moves them into compressed archives. Archived data is not searchable at the speed of the index, but it can be loaded back when a real question arrives.
A sensible shape for many small networks: a few months live, the rest of the promised period archived. The exact split follows your investigation habits: if you regularly dig three months back, keep three months live and pay for the disk gladly.
EventLog Analyzer ships report templates aligned to frameworks such as PCI DSS, HIPAA, SOX and GDPR, and those frameworks care about log availability and review. What they do not do is pick your disk size. The retention period your organisation must honour comes from your own obligations, contracts and policies, which differ between a payment-handling business and a school.
Write the chosen period down as policy, with the reason attached. When the disk bill arrives, that piece of paper is the difference between a budget conversation and an argument.
Retention multiplies your daily volume, as the sizing guide in this series shows. Doubling retention roughly doubles stored data. There is no compression magic that makes a year of a busy firewall cheap, and archive storage still needs backup like any other evidence store.
If the honest math does not fit the budget, adjust the inputs, not the truth: trim the noisiest audit categories, shorten the live period while keeping archives, or accept a shorter total retention with your eyes open and the decision documented.
Once a quarter, pick an archived period, load it back, and run one search. Archives that have never been restored are a hope, not a capability, and the failure modes (moved share, missing permissions, corrupted file) are all quiet ones.
Note the date of the oldest data you actually hold, and compare it with the policy promise. If reality is shorter than the promise, fix it this week; discovering the gap during an investigation is the expensive way.
Retention settings live a few clicks from the install the video walks through. Set them deliberately in the same session, not someday.
▶️ Watch Full VideoAs long as your compliance obligations, contracts and incident history demand, which for many organisations lands between six months and a few years in total. Keep the recent slice in the live index for fast search and the remainder as archives. The right number is a documented policy decision, not a product default.
The data is the same records, compressed for storage. The difference is speed and convenience: archives must be loaded back before searching, while the live index answers in seconds. For old investigations that trade is exactly right.
It is deleted by the system according to the schedule you set, and deletion is final. That is why the retention number deserves a meeting: it is the date beyond which your network's memory provably ends.