Retention period should not be set according to the size of the disk, but according to how quickly incidents are detected and resolved in practice. Longer retention must have a clear justification.
Practical default
In most common cases, short retention (on the order of tens of hours to units of days) is indicated as a reasonable basic framework. If you need more, there must be a "why" in the documentation.
The retention period is usually included balance test and internal rules.
Review and sources
Verified sources for this term
Updated May 26, 2026