# Inactive CloudWatch log group | Cloud Efficiency Hub Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/inactive-cloudwatch-log-group CloudWatch log groups often persist long after their usefulness has expired. By: Taylor Houck Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Inactive CloudWatch Log Group The short version CloudWatch log groups often persist long after their usefulness has expired. [Taylor Houck](https://www.linkedin.com/in/twhouck/) Cloud FinOps Specialist @ PointFive AWS service [AWS CloudWatch](https://www.pointfive.co/efficiency-hub/cloud-services/aws-cloudwatch) Category [Other](https://www.pointfive.co/efficiency-hub/service-category/other) Reference CER-0060 Type Idle or Unused Resource ## Explanation Why the waste happens and who it affects. In some cases, they are associated with applications or resources that are no longer active. In other cases, the systems may still be running, but the log data is no longer being reviewed, analyzed, or used by any team. Regardless of the reason, retaining logs that no one is monitoring or using results in unnecessary storage costs. If log data is not needed for operational visibility, debugging, compliance, or auditing purposes, it should either be deleted or managed with a shorter retention policy. CloudWatch Logs stores log data indefinitely by default: every new log group, including those created automatically by Lambda, ECS, EKS, API Gateway, VPC Flow Logs and applications, is set to Never Expire until someone configures a retention period. Active log groups that are still receiving data therefore accumulate archived storage every month even when only the last few days or weeks are ever queried. ## Billing model The pricing dimensions that drive this cost. CloudWatch Logs are billed on a usage-based model, with charges incurred for: Log ingestion Cost per GB of log data sent to CloudWatch Log storage Ongoing cost per GB-month for data retained in log groups, regardless of access or usage Log queries and insights Additional charges apply when querying or analyzing logs Archived log storage Billed per GB-month for all data retained in a log group ($0.03 per GB in the CloudWatch pricing examples for US East (N. Virginia)) Expired events Once log events pass the retention setting they are marked for deletion and stop adding to archival storage cost, even if physical deletion takes up to 72 hours ## How to detect 9 checks to find it in your estate. - Identify log groups with significant stored log volume but no recent ingestion activity - Review historical usage to determine if log data is still being used for operational, security, or compliance purposes - Evaluate whether the log group is associated with an active application or AWS resource - Check whether the log group has a defined retention policy or is defaulting to indefinite storage - Confirm there are no current alerts, dashboards, or queries relying on data within the log group - Validate with relevant stakeholders (e.g., DevOps, security, compliance) whether the log group is still required - Run describe-log-groups and list log groups with no retentionInDays value (Never Expire), ranked by storedBytes - Review log groups whose retention is far longer than any operational, security or compliance requirement - Check IaC modules and service defaults that create log groups without a retention setting; note that the AWS Config managed rule cw-loggroup-retention-period-check checks for a minimum retention and reports Never Expire log groups as COMPLIANT, so it will not flag this pattern ## How to fix 3 ways to remove the waste. Apply appropriate retention policies to automatically expire old logs or manually delete inactive log groups that are no longer needed. Where appropriate, implement automated cleanup routines to routinely identify and remove unused log groups. - Set retention on every log group with put-retention-policy, based on how long each log type is actually needed (for example short retention for debug and access logs, longer for audit logs) - Export or subscribe logs that must be kept long term to Amazon S3 and manage them there with S3 lifecycle rules instead of indefinite CloudWatch retention - Enforce a retention value at creation time in IaC templates and log group creation automation, since service-created log groups default to Never Expire ## Documentation Vendor references for pricing and configuration. [CloudWatch Pricing](https://aws.amazon.com/cloudwatch/pricing/) - [Working with log groups and log streams docs.aws.amazon.com](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Working-with-log-groups-and-streams.html) - [Analyzing, optimizing, and reducing CloudWatch costs docs.aws.amazon.com](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_billing.html) - [cw-loggroup-retention-period-check - AWS Config docs.aws.amazon.com](https://docs.aws.amazon.com/config/latest/developerguide/cw-loggroup-retention-period-check.html) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - AWS CloudWatch CER-0381 ### [Orphaned CloudWatch Alarms for Deleted Resources](https://www.pointfive.co/efficiency-hub/inefficiencies/orphaned-cloudwatch-alarms-for-deleted-resources) CloudWatch alarms are not deleted when the resource they watch goes away. When an EC2 instance, Lambda function, load balancer, queue or database is removed, its alarms keep existing and typically move to the INSUFFICIENT\_DATA state... Other - AWS CloudWatch CER-0233 ### [Overly Permissive VPC Flow Log Filters Sent to CloudWatch Logs](https://www.pointfive.co/efficiency-hub/inefficiencies/overly-permissive-vpc-flow-log-filters-sent-to-cloudwatch-logs) VPC Flow Logs configured with the ALL filter and delivered to CloudWatch Logs often result in unnecessarily high log ingestion volumes - especially in high-traffic environments. This setup is rarely required for day-to-day monitoring or... Other - AWS CloudWatch CER-0224 ### [Suboptimal Log Class Configuration in CloudWatch](https://www.pointfive.co/efficiency-hub/inefficiencies/suboptimal-log-class-configuration-in-cloudwatch) By default, CloudWatch Log Groups use the Standard log class, which has a higher per-GB ingestion price. AWS also offers an Infrequent Access (IA) log class designed for logs that are rarely queried - such as audit trails, debugging... Other --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.