Retention log

Question

Hi all,

I would like to know some information about the Sentinel log ingestion pricing.

My goal is to increase this period to 1 year.

What I read is the possibility not to ingest that log (saving money) but to use the archived period to store these logs.

1. Can anyone explain how the total retention period works?

If we enable this option and increase it to 1 year, will we pay 0.03€ for GB ingested? (Region: France Central)

2. If we would like to restore this log we can pay only 0.13€ for GB for the amount of log to restore (multiply the amount of data by the number of data to restore).

Thank you

Answer 1

Roberto D'Andrea, thank you for the reply.

The archival will happen after the ingestion. By default, all tables in your workspace inherit the workspace's interactive retention setting and have no archive. You can modify the retention and archive settings of individual tables. To summarize, the data ingested is available for interactive query for a minimum of 30 days. Based on your archival setting, the data older than 30 days are archived which are available for restoration later for querying.

For more details, see Data retention and archive in Azure Monitor Logs.

Hope this helps.

If the answer did not help, please add more context/follow-up question for it. Else, if the answer helped, please click Accept answer so that it can help others in the community looking for help on similar topics.

Answer 2

Hello,

The Azure pricing calculator will help https://azure.microsoft.com/en-us/pricing/calculator/

Use it to compare the options based on your ingestion

Also read: https://azure.microsoft.com/en-us/pricing/details/monitor/

NOTE: Restore is for 2TB, so factor that in if your are going to restore often.

So when you compare the two, then factor in some restores

One restore a month could be a similar cost as the normal retention