Log retention policy
|
Log storage is fixed and log storage usage depends on factors such as number of users, number of policies with logging enabled, and logging type selected (security events, all sessions) for such policies. If log rotation occurs ahead of the configured log retention period, open a FortiCare support ticket to request a log storage increase for your instance. |
You can configure FortiSASE to store logs up to a certain number of days that you specify as the log retention policy. FortiSASE automatically deletes logs that are older than the specified log retention (days).
All FortiSASE instances have log retention enabled with a log retention period of 30 days by default. You can configure the log retention policy to between 2 to 30 days. The policy applies to traffic, security, and event logs.
To store logs for a longer duration, configuring log forwarding to an external server is advised. See Forwarding logs to an external server.
To configure log retention policy:
- Go to Analytics > Settings.
- Enable the Analytics Retention toggle and set the Log Retention (days) to the required number of days.
- Click OK to save the changes.