Forum Discussion
Azure Activity Log Retention
Jagadt, the storage retention configuration options between Activity Log and NSG Flow Logs are not consistent, as you stated. A recent document confirms that Activity Logs are retained forever in Storage Accounts. However, there might be some good reason for that. For example, NSG Flow Logs also had recently, during some weeks, no retention options available, until it became available again with storage lifecycle integration. So I believe that sooner or later the same will happen to Activity Log.
Regarding the second question, immutable time-based locked policies will take precedence over lifecycle management policies.
hspinto - Thanks for your response. Yes I agree with storage lifecycle policy, however we do have option to set up retention while exporting NSG flow logs (through Network watcher) to these storage account v2 . This enabling us to see this retention policy rule automatically created under storage lifecyle policy. So not sure why we don't have such option while enabling retention at activity log level which would have created retention policy rule automatically??
Second Question: I am enabling immutable storage policy by setting up lock time based retention policy for 365 days and then parallely I am enabling storage lifecycle policy having to delete blob after 365 days. Which one will take precedence or how does it work? Any ideas?
MicrosoftJagadt, the storage retention configuration options between Activity Log and NSG Flow Logs are not consistent, as you stated. A recent document confirms that Activity Logs are retained forever in Storage Accounts. However, there might be some good reason for that. For example, NSG Flow Logs also had recently, during some weeks, no retention options available, until it became available again with storage lifecycle integration. So I believe that sooner or later the same will happen to Activity Log.
Regarding the second question, immutable time-based locked policies will take precedence over lifecycle management policies.
hspinto - Thanks for the clarification. Based on the consideration referred in the article, it says the below but can we apply lifetime policy to delete the blob based on the retention duration, for example delete blob after 365 days?
- The retention setting for collecting the Activity log to Azure storage has been removed meaning that data will be stored indefinitely until you remove it.
Regards,
Jagadeesh