Forum Discussion
Can I enable storage account lifecycle management for my log analytics workspace?
- Oct 21, 2021
Jeff Walzer Log analtics on a back end use storage data retention/lifecycle definition: the represents how long (the amount of time in days ) data is kept inside an Azure Log Analytics workspace (see Change the data retention period paragraph in this article .https://docs.microsoft.com/en-us/azure/azure-monitor/logs/manage-cost-storage#change-the-data-retention-period
“Table Level” retention will allow you to apply a different retention setting for specific Log Analytics tables. This eliminates the need to create a separate workspace when you need different retention settings for specific data types. For example, if you need to comply with a regulation which dictates that you need to save security alerts for 2 years, but there is no need to save performance counters longer than 7 days, then Table Level retention is going to solve that challenge.
Also few things to consider- Correlation among tables could be impacted by different retention
- Changing the retention at the workspace level will change the table retention any longer on the one previously modified
- Should you need to align back to workspace retention, you need to reset what has been configured using the same method used to set it, hence you will get through the same steps and level of complexity.
Hope I answered your question
Chandrasekhar_Arya- TYVM for the reply and information as I was thinking a storage account was the backend for an LA workspace, whereas it's a DB table
https://cloudadministrator.net/2019/10/16/set-per-table-retention-in-log-analytics-via-arm-template/
https://www.risual.com/2020/10/azure-log-analytics-workspace/#:~:text=Table-Level%20Retention%20Within%20the%20Microsoft%20Azure%20cloud%20platform%2C,and%20proactively%20protecting%20against%20threats%20to%20the%20environment.
https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/azure-log-analytics-data-retention-by-type-in-real-life/ba-p/1416287