Data retention policy

This section describes how the upgrade from FortiAnalyzer 5.2.x to 5.4.0 and later affects the data retention policy for existing and new ADOMs.

Existing ADOMs

For existing ADOMs, both Archive logs and Analytics logs are kept for 365 days + the age in days of the oldest Archive/Analytics logs respectively. For example, the oldest Archive logs of a device were generated on February 1, 2016, and the oldest Analytics logs were generated on March 1, 2016. Today is April 7. So the oldest Archive logs are 67 days old, and the oldest Analytics logs are 38 days old. After upgrade to 5.4.0 and later, FortiAnalyzer will keep the Archive logs for 365+67=432 days, and keep the Analytics logs for 365+38=403 days.

New ADOMs

For newly created ADOMs, Archive logs are kept for 365 days, and Analytics logs are kept for 60 days.