Ask the Expert

Best practices for log data retention

As a best practice, how long should an organization retain log data for the purpose of incidence response? I haven't been able to find any legal requirements. Is six months long enough? Are there are any industry guidelines we should use?

    Requires Free Membership to View

In some sense the correct answer is: Retain as much data as you can easily store and analyze in a reasonable amount of time when you need incident response/forensic analysis.

The reality is, as usual, more complex than that. In December 2006, the U.S. government changed the Federal Rules of Evidence for electronic data, and these rules were picked up by most of the states as well. The most relevant of these changes was that not only do electronic files themselves fall under the scope of discovery, but also any and all meta data, which includes logs.

This means the company must ensure log data is properly maintained under a written document-retention policy and that it's clear which relevant files may correlate with the logs. This is important because during a civil litigation procedure, the organization must know which logs to produce for the lawyers and which logs not to destroy as part of the usual document destruction process.

This is just a long and fancy way to say you should talk to your organization's lawyers and make a decision about how long to retain logs on the basis of their advice.

For more information:

This was first published in March 2009

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: