Agent WranglersAudit logs and access Required
Keep audit logs for a set time
Keep audit logs for a stated period, longer than debug logs, then delete them on schedule.
How to do it
Pick the period from your duties and write it in the retention schedule. At least 12 months is a common floor. PCI DSS 4.0 requirement 10.5.1 asks for 12 months, with the last three months ready to search at once. Keep audit logs apart from debug logs, which follow the log retention rule. Set the storage lock to the same period, so deletion and protection agree.
How to check
A daily query fails when the oldest audit event is older than the stated period plus one day. It also fails when the log has run longer than the period but its oldest event is younger. The storage lock period equals the stated period.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-retention.