# Excessive retention of audit logs | Cloud Efficiency Hub Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-retention-of-audit-logs Audit logs are often retained longer than necessary, especially in environments where the logging destination is not carefully selected. By: Jurian van Hoorn [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Excessive Retention of Audit Logs The short version Audit logs are often retained longer than necessary, especially in environments where the logging destination is not carefully selected. [Jurian van Hoorn](https://www.linkedin.com/in/j-hoorn/) Operations Senior (Azure Cloud) @ Netcompany Azure service [Azure Blob Storage](https://www.pointfive.co/efficiency-hub/cloud-services/azure-blob-storage) Category [Storage](https://www.pointfive.co/efficiency-hub/service-category/storage) Reference CER-0268 Type Excessive Data Retention ## Explanation Why the waste happens and who it affects. Projects that initially route SQL Audit Logs or other high-volume sources to LAW or Azure Storage may forget to revisit their retention strategy. Without policies in place, logs can accumulate unchecked - particularly problematic with SQL logs, which can generate significant volume. Lifecycle Management Policies in Azure Storage are a key tool for addressing this inefficiency but are often overlooked. However, tier transitions are not always cost-saving. For example, in cases where log data consists of extremely large numbers of very small files (such as AKS audit logs across many pods), the transaction charges incurred when moving objects between storage tiers may exceed the potential savings from reduced storage rates. In these scenarios, it can be more cost-effective to retain logs in Hot tier until deletion, rather than moving them to lower-cost tiers first. ## Billing model The pricing dimensions that drive this cost. Storage costs accrue based on: Volume of data stored per tier (Hot, Cool, Archive) Duration retained (GB-months) Log Analytics data stored in Analytics or Basic tables (charged per GB ingested and retained) Audit logs routed to LAW or Storage will continue to generate cost until explicitly deleted or transitioned to a cheaper tier. ## How to detect 6 checks to find it in your estate. - Identify resources with Audit Logging enabled - Determine whether logs are routed to Log Analytics Workspace or Azure Storage - Assess whether current retention aligns with compliance or operational needs - Evaluate volume and cost of logs retained beyond required periods - Review whether lifecycle policies or retention settings are currently configured - Check if any projects have a "set and forget" logging configuration that has never been reviewed ## How to fix How to remove the waste. Apply Azure Storage Lifecycle Management Policies to transition older logs to lower-cost tiers or delete them after a set retention period. Before implementing tier transitions, assess whether the additional transaction costs from moving large volumes of small log files could outweigh potential storage savings. In such cases, consider retaining logs in Hot tier until deletion if that results in lower overall cost. For logs in Log Analytics Workspace, assess whether they can be moved to Basic tables or stored in Storage Accounts instead Establish project-specific retention requirements with stakeholders and enforce them across all audit logging configurations Periodically audit logging destinations and lifecycle settings to prevent silent cost creep ## Documentation Vendor references for pricing and configuration. - [Azure Storage Lifecycle Management Overview learn.microsoft.com](https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - Azure Blob Storage CER-0431 ### [Unmanaged Blob Versions and Soft-Deleted Data Accumulation](https://www.pointfive.co/efficiency-hub/inefficiencies/unmanaged-blob-versions-and-soft-deleted-data-accumulation) Blob versioning and blob soft delete are part of Microsoft's recommended data protection configuration, so they are often switched on for every storage account. With versioning enabled, every write to a blob (Put Blob, Put Block List, Copy... Storage - Azure Blob Storage CER-0335 ### [Excessive Transaction Cost Overhead on Blob Storage from I/O-Intensive Workloads](https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-transaction-costs-from-filesystem-style-access-patterns-on-blob-storage) Azure Blob Storage and ADLS Gen2 bill per transaction - every list, read, write, rename, and metadata operation is a separately metered API call. When organizations migrate workloads from on-premises Hadoop/HDFS environments or local... Storage - Azure Blob Storage CER-0172 ### [High Transaction Cost Due to Misaligned Tier in Azure Blob Storage](https://www.pointfive.co/efficiency-hub/inefficiencies/high-transaction-cost-due-to-misaligned-tier-in-azure-blob-storage) Azure Blob Storage tiers are designed to optimize cost based on access frequency. However, when frequently accessed data is stored in the Cool or Cold tiers - either due to misconfiguration, default settings, or cost-only optimization -... Storage --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.