Azure Law Retention
Note: By default, retention for Application Insight data types lasts 90 days and receives workspace retention if it is longer than 90 days. Workspaces created before April 2016 can continue to use the standard and premium plans, which have a fixed data retention of 30 days and 365 days, respectively. New workspaces cannot be created in the Standard or Premium tiers, and if a workspace is moved out of those tiers, it cannot be moved backwards. Workspaces in these tiers do not support the use of basic protocols. The data collection counters on your Azure invoice for these legacy tiers are called “data analytics.” This example sets the interactive retention of the table to the workspace standard of 30 days and the total retention over two years, which means that the retention period is 23 months. Step 4: Under Usage and Estimated Cost, select Data Retention. During the interactive retention period, data is available for monitoring, troubleshooting, and analysis. If you no longer use logs, but still need to retain data for compliance or occasional investigation, archive logs to reduce costs. If you want to reset the default interactive retention values from the workspace to the table and the total retention to 0, you must use the following command. Archived data remains in the same table, along with data available for interactive queries. If you set a total retention period greater than the interactive retention period, Log Analytics automatically archives the relevant data immediately at the end of the retention period.
A multi-day grace period begins when retention is reduced before the oldest data is deleted. Note that increasing data retention will result in additional Azure costs. By default, logging through the tyGraph Pages engine includes 90 days of retention for data stored in the Application Insights Log Analytics workspace. For more information, see Azure pricing. For SaaS-hosted customers, please contact tyGraph Support to adjust your customer loyalty. Depending on storage needs and your license agreement, additional charges may apply. To change retention, go to the Usage and Estimated Cost page of your Application Insights resource and select the Data Retention option: Now that we receive the retention period, we can set retention based on our needs by limiting daily data consumption to 500 MB under the ARM Workspaces command in the Free Trial pricing tier (excluding security data types, that are captured by Microsoft Defender for Cloud). and data retention is limited to seven days. The free trial tier is for evaluation purposes only.
No SLAs are provided for the free tier. After you find the table you want to modify, run the following command and pass the desired values for the –retention-time and –total-retention-time parameters. Workspace-based Application Insights resources store data in a Log Analytics workspace so that it is included in the workspace`s data retention and archiving settings. However, classic Application Insights resources have separate retention settings. By default, all tables in your workspace inherit the interactive retention setting of the workspace and do not have an archiving policy. You can change the retention and archiving policies for individual tables, except for workspaces in the old free trial tier. You do not explicitly specify the archive time in the API call. Instead, you specify total retention, which is the sum of the interactive retention plus the retention period. By default, data retention is set to 30 days, which you can change if necessary. First, use the following command to list all the tables in your workspace. There you will see the name of the table and the corresponding log retention.
The Log Analytics Cleanup API does not affect the retention debacle. To reduce retention costs, reduce the retention period for the workspace or specific tables. To retrieve all table-level retention policies in your workspace, do not specify a table name. For example, option 2 is to restore your archive logs, which also copy the data to a new table. This allows you to recover data worth up to 60 TB. The new table has a name with the suffix “_RST”, uses the “Analytics” plan, and is of type “Logs restored”. NO interactive retention period is configured for this new table. It remains in LAW forever until you delete the table or the archiving log data becomes too old and exceeds the entire retention period (remember, this can take years).
As you know, each workspace has a default retention policy that applies to all tables. However, you can set a different retention policy for individual tables if you want. In this article, I want to show you how to configure a data retention policy for individual tables in Log Analytics using the Azure CLI. Using Azure Log Analytics with optimal settings helps organizations gain visibility, reduce costs, ensure data protection, and comply with regulatory compliance. Data retention is an important parameter. Set it wisely. The definition of retention is just as simple. For example, you set Retention for SecurityEvents to 730 days: Tables for Application Insights resources also keep data for free for 90 days. You can customize the retention policy for each of these tables individually. When you shorten an existing retention policy, it takes Azure Monitor several days to delete data that you no longer want to keep. You can configure specific tables in a Log Analytics workspace to use basic logs.
The data in these tables show a significant reduction in admission fees and a limited retention period. However, there is an indictment to search for these tables.