How to configure the archive retention period using ADAudit Plus

How to configure the archive retention period using ADAudit Plus

Objective   

This article explains how to configure the archive retention period using ADAudit Plus to define how long archived event data is retained before being automatically deleted. Proper configuration of the retention period helps optimize storage usage, maintain compliance with data retention policies, and ensure efficient long-term log management.

 Prerequisites    

  • Have access to the ADADAudit Plus web console.

  • Have a user account with administrator privileges or a technician account with delegated permissions to configure or update archive settings.

  • Have sufficient disk space and a storage plan.

Steps to follow

Step1: Enable archive retention in ADAudit Plus 

  1. Log in to the ADAudit Plus web console using an account with an administrator role or a technician account with delegated permissions to configure or update archive settings.
  2. Navigate to Admin > Configuration > Archive Events.

  3. Locate the desired category and click the gear icon next to it to configure its archive settings.

    • Hot Data Retention Time: Defines how long the active logs are retained before they are moved to archive storage. This setting controls the availability of logs in real-time reports.

    • Cold Data Retention Time (specific to DataEngine reports): Specifies how long index data is retained for archived logs to enable faster retrieval and report generation.

    • Frozen Data Retention Time: Determines how long archived logs are stored before being permanently deleted. This setting is crucial for fulfilling compliance and audit requirements.

    • Configure each retention duration based on your organization’s operational, auditing, and compliance needs:

      1. Set an appropriate hot data duration for quick access logs.

      2. Use cold data retention wisely if rapid archive reporting is required.

      3. Set frozen data retention to meet long-term data retention or regulatory obligations.

        4. Click Save to apply the configuration.

Step 2: Configure a recovery window for archived data

  1. Navigate to Admin > Configuration > Archive Events. Choose Recovery settings in the top-right to configure a recovery window (default: 20 days, max: 30 days). Setting the window to zero days deletes data permanently without recovery.

Step 3: Review and monitor the archived data deletion summary

  1. Navigate to Admin > Configuration > Archive Events.
  2. Click Deletion Summary.

  3. View recently deleted files under Deletion History.

  4. Check scheduled deletions under Deletion Schedule.

Validation and confirmation

  1. Navigate back to Admin > Configuration > Archive Events and ensure your configured retention settings are reflected correctly for the report profile.
  2. Monitor upcoming archive cycles to confirm logs are moved or deleted as per the newly defined timeframes.

Tips

  • Align retention periods with compliance mandates and match the retention settings to legal and industry requirements, such as the GDPR, HIPAA, or SOX, to avoid under- or over-retention.
  • Balance accessibility vs. storage usage:

    • Keep hot data short for high-volume environments to conserve performance.

    • Enable cold data only if rapid retrieval of archived logs is essential.

    • Set frozen data retention conservatively if disk space is a concern.

  • Periodically audit the storage used by archive folders to ensure your retention strategy isn’t causing excessive storage consumption.