Log storage
Answers to frequently asked questions about log retention behavior and log storage capacity in Data Security Center (DSC).
Why can I still see logs older than 30 days after setting the retention period to 30 days?
This is expected. Simple Log Service (SLS), which DSC uses as the underlying log storage backend, applies retention at the file level, not the log entry level. A log file is only deleted when every log entry in it exceeds the retention period.
For example, if a file contains logs from day 28 and day 31, and the retention period is 30 days, the file stays until the day-28 logs also pass the 30-day mark — at which point the entire file is deleted. Until then, the day-31 logs remain visible even though they exceeded the retention period.
Logs in this pending-cleanup state do not consume extra storage or incur additional charges. This file-level approach avoids fragmentation from file sharding and keeps storage cleanup efficient.
Can logs still be written after a log storage alert appears?
No. When log storage space is insufficient, DSC suspends log ingestion immediately. Upgrade your storage space as soon as possible to resume normal audit log writing.
Does log storage only store online logs?
No. DSC stores two types of logs:
| Log type | Where it's stored |
|---|---|
| Online logs | Simple Log Service (SLS), based on your configured online log query time |
| Archived logs | Object Storage Service (OSS), after automatic archiving compresses and moves logs from SLS; consumes less storage than online logs in most cases |
To enable automatic archiving, see Configure log storage rules. After archiving is configured, see Query archived logs to search your archived data.
For a full overview of log storage settings, see Manage log storage. To view audit logs stored in SLS, see View audit logs.