---
title: "Keep audit logs for a set time · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-retention
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep audit logs for a set time

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Audit logs and access](https://agentwranglers.se/playbook/compliance/audit-logs-and-access)
- Rule: Keep audit logs for a stated period, longer than debug logs, then delete them on schedule.
- How: Pick the period from your duties and write it in the retention schedule. At least 12 months is a common floor. PCI DSS 4.0 requirement 10.5.1 asks for 12 months, with the last three months ready to search at once. Keep audit logs apart from debug logs, which follow the [log retention rule](https://agentwranglers.se/playbook/operations/logs/log-retention). Set the storage lock to the same period, so deletion and protection agree.
- Check: A daily query fails when the oldest audit event is older than the stated period plus one day. It also fails when the log has run longer than the period but its oldest event is younger. The storage lock period equals the stated period.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-retention`.

- Previous: [Make the audit log impossible to change](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-immutable)
- Next: [Review access every quarter](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/access-reviews)
- [Audit logs and access](https://agentwranglers.se/playbook/compliance/audit-logs-and-access)