Unable to View Historical Logs in Log Analytics Workspace

Question

Why am I unable to view old logs in my Log Analytics workspace, and how can I resolve this issue?

PS - Based on common issues that we have seen from customers and other sources, we are posting these questions to help the Azure community.

Answer 1

The issue of not being able to view old logs in your Log Analytics workspace is typically due to the data retention settings. By default, the data retention period in Azure Log Analytics is set to 30 days for Audit Logs. If the logs you are trying to access are older than this period, they will not be available.

To verify and adjust the data retention settings, follow these steps:

1. Check the data retention settings in your Log Analytics workspace. This can be done by navigating to your Log Analytics workspace in the Azure portal and reviewing the data retention policies under the "Usage and estimated costs" section.
2. Increase the data retention period if you need to keep logs for longer than the default period. This can be adjusted under the same section by modifying the retention policies according to your requirements.

Keep in mind that increasing the data retention period may impact the cost of your Log Analytics workspace, as you will be storing more data for a longer period. Ensure that you are aware of the cost implications before making any changes.

For more detailed information on data retention settings and how to configure them, you can refer to the official documentation: Azure Monitor Logs retention and archiving.

Please do not forget to "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.