Work out log retention for compliance instantly with clear inputs, formula shown and shareable results.
Compliance regimes set retention floors — PCI DSS requires a year with three months immediately available, and several regulators require longer — which naturally produces a two-tier design. The hot tier is sized for investigation and stays uncompressed and indexed; the cold tier holds the remainder compressed, typically at 5 to 10 times, at a fraction of the cost per gigabyte.
Log storage
hot = daily volume x hot days; cold = daily volume x cold days / compression ratio; total = hot + cold
At least 12 months of audit log history, with a minimum of three months immediately available for analysis, which is exactly the hot and cold split.
Yes for the hot tier. Search indexes commonly add 10 to 50 percent on top of raw volume depending on the platform and field extraction.