SOLVED
Home

Sentinel storage is based on Log Analytics? How can we extend past 730 day limit?

%3CLINGO-SUB%20id%3D%22lingo-sub-689439%22%20slang%3D%22en-US%22%3ESentinel%20storage%20is%20based%20on%20Log%20Analytics%3F%20How%20can%20we%20extend%20past%20730%20day%20limit%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-689439%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%2C%20we%20have%20a%20Customer%20that%20requires%20a%20retention%20limit%20of%203%20years%20and%20at%20the%20moment%20we%20seem%20to%20be%20restricted%20via%20Log%20Analytics%20to%20a%20default%20of%20730%20days%3F%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-subscription-service-limits%23log-analytics-limits%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-subscription-service-limits%23log-analytics-limits%3C%2FA%3E%3C%2FP%3E%3CP%3EIs%20there%20any%20way%20of%20extending%20this%20beyond%20the%20730%20day%20limit%20via%20other%20storage%20mechanisims%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-694648%22%20slang%3D%22en-US%22%3ERe%3A%20Sentinel%20storage%20is%20based%20on%20Log%20Analytics%3F%20How%20can%20we%20extend%20past%20730%20day%20limit%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-694648%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F129396%22%20target%3D%22_blank%22%3E%40David%20Caddick%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20workspace%20retention%20cannot%20be%20extended%20beyond%20730%20days%20as%20of%20now.%20We%20are%20working%20on%20a%20solution%20to%20stream%20data%20to%20a%20colder%20storage.%20For%20now%2C%20the%20available%20option%20is%20to%20create%20a%20program%20(Azure%20functions%2C%20PowerShell%2C%20Logic%20Apps)%20that%20will%20read%20the%20date%20using%20the%20Log%20Analytics%20API%20and%20send%20it%20external%20storage.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E~%20Ofer%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-695027%22%20slang%3D%22en-US%22%3ERe%3A%20Sentinel%20storage%20is%20based%20on%20Log%20Analytics%3F%20How%20can%20we%20extend%20past%20730%20day%20limit%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-695027%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F293879%22%20target%3D%22_blank%22%3E%40Ofer_Shezaf%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHere%20in%20Western%20Australia%20we%20have%20the%20local%20%22Office%20of%20Auditor%20General%22%20reviewing%20local%20State%20Govt.%20departments%20and%20insisting%20that%20the%20policy%20is%203%20years%2C%20I%20am%20assuming%20it%20is%20similar%20in%20most%20states%20and%20internationally%20this%20is%20likely%20to%20have%20other%20policies%20that%20are%20longer%20than%20the%20existing%202%20years%3F%3CBR%20%2F%3EWe'll%20run%20with%202%20Years%20(730%20days)%20for%20now%20and%20make%20a%20determination%20on%20that%20later%20-%20can%20you%20advise%20what%20the%20best%20process%20is%20to%20formally%20request%20this%20so%20this%20request%20can%20be%20tracked%3F%20Should%20it%20be%20simply%20via%20a%20Support%20request%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3CBR%20%2F%3EDave%20C%3C%2FP%3E%3C%2FLINGO-BODY%3E
Frequent Contributor

Hi All, we have a Customer that requires a retention limit of 3 years and at the moment we seem to be restricted via Log Analytics to a default of 730 days?
https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits#log-analytics-limits

Is there any way of extending this beyond the 730 day limit via other storage mechanisims?

2 Replies
Solution

@David Caddick 

 

The workspace retention cannot be extended beyond 730 days as of now. We are working on a solution to stream data to a colder storage. For now, the available option is to create a program (Azure functions, PowerShell, Logic Apps) that will read the date using the Log Analytics API and send it external storage.

 

~ Ofer

Thanks @Ofer_Shezaf 

 

Here in Western Australia we have the local "Office of Auditor General" reviewing local State Govt. departments and insisting that the policy is 3 years, I am assuming it is similar in most states and internationally this is likely to have other policies that are longer than the existing 2 years?
We'll run with 2 Years (730 days) for now and make a determination on that later - can you advise what the best process is to formally request this so this request can be tracked? Should it be simply via a Support request?

 

Regards,
Dave C

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies