# Audit log retention period

**URL:** <https://community.palantir.com/t/audit-log-retention-period/1766>\
**Category:** Ask the Community\
**Tags:** audit-logs\
**Created:** [November 6, 2024, 9:42am UTC](https://community.palantir.com/t/audit-log-retention-period/1766 "2024-11-06T09:42:46Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kentaro\_Koyama](https://avatars.discourse-cdn.com/v4/letter/k/f19dbf/32.png) [@Kentaro\_Koyama](https://community.palantir.com/u/Kentaro_Koyama)\
**Post date:** [November 6, 2024, 9:42am UTC](https://community.palantir.com/t/audit-log-retention-period/1766/1 "2024-11-06T09:42:46Z")

</div>

What is the retention period for audit logs?

---

<div class="post-metadata">

**Author:** ![redboyben](https://avatars.discourse-cdn.com/v4/letter/r/96bed5/32.png) [@redboyben](https://community.palantir.com/u/redboyben)\
**Post date:** [November 14, 2024, 10:52am UTC](https://community.palantir.com/t/audit-log-retention-period/1766/2 "2024-11-14T10:52:41Z")

</div>

This is a setting that you can set yourself in the audit logs export configuration from control panel: you can set the starting date as well as the desired retention (you can also decide keep everything).

---

<div class="post-metadata">

**Author:** ![Kentaro\_Koyama](https://avatars.discourse-cdn.com/v4/letter/k/f19dbf/32.png) [@Kentaro\_Koyama](https://community.palantir.com/u/Kentaro_Koyama)\
**Post date:** [November 15, 2024, 2:30am UTC](https://community.palantir.com/t/audit-log-retention-period/1766/3 "2024-11-15T02:30:09Z")

</div>

thank you.  
I have already exported the audit logs to a dataset, but I don’t remember what I set for the retention period, is it possible to check it somewhere?

---

<div class="post-metadata">

**Author:** ![redboyben](https://avatars.discourse-cdn.com/v4/letter/r/96bed5/32.png) [@redboyben](https://community.palantir.com/u/redboyben)\
**Post date:** [November 15, 2024, 9:52am UTC](https://community.palantir.com/t/audit-log-retention-period/1766/4 "2024-11-15T09:52:16Z")

</div>

The quickest would be to sort your ingest by ascending time to get the earliest date of your data!  
You can also delete it and recreate it if you want to set something different.

---

<div class="post-metadata">

**Author:** ![Kentaro\_Koyama](https://avatars.discourse-cdn.com/v4/letter/k/f19dbf/32.png) [@Kentaro\_Koyama](https://community.palantir.com/u/Kentaro_Koyama)\
**Post date:** [November 19, 2024, 9:23am UTC](https://community.palantir.com/t/audit-log-retention-period/1766/5 "2024-11-19T09:23:02Z")

</div>

When creating an “audit log dataset”, I can specify “Retention in days (max 2 years)”, but if I do not specify this, will the retention period be 2 years?

---

<div class="post-metadata">

**Author:** ![redboyben](https://avatars.discourse-cdn.com/v4/letter/r/96bed5/32.png) [@redboyben](https://community.palantir.com/u/redboyben)\
**Post date:** [November 20, 2024, 3:02pm UTC](https://community.palantir.com/t/audit-log-retention-period/1766/6 "2024-11-20T15:02:02Z")

</div>

If you do not set retention, no retention rule will be applied to your export dataset.

---

<div class="post-metadata">

**Author:** ![Kentaro\_Koyama](https://avatars.discourse-cdn.com/v4/letter/k/f19dbf/32.png) [@Kentaro\_Koyama](https://community.palantir.com/u/Kentaro_Koyama)\
**Post date:** [November 21, 2024, 2:36am UTC](https://community.palantir.com/t/audit-log-retention-period/1766/7 "2024-11-21T02:36:56Z")

</div>

Thank you for your reply.  
Does this mean that unless a retention period is set, audit logs will not be deleted even after two years?  
Sorry for asking you so many questions.

---

<div class="post-metadata">

**Author:** ![redboyben](https://avatars.discourse-cdn.com/v4/letter/r/96bed5/32.png) [@redboyben](https://community.palantir.com/u/redboyben)\
**Post date:** [November 21, 2024, 10:20am UTC](https://community.palantir.com/t/audit-log-retention-period/1766/8 "2024-11-21T10:20:37Z")

</div>

Don’t worry about it!  
That is correct 🙂

---

<div class="post-metadata">

**Author:** ![sandpiper](https://yyz1.discourse-cdn.com/palantir/user_avatar/community.palantir.com/sandpiper/32/273_2.png) [@sandpiper](https://community.palantir.com/u/sandpiper)\
**Post date:** [November 21, 2024, 10:20pm UTC](https://community.palantir.com/t/audit-log-retention-period/1766/9 "2024-11-21T22:20:03Z")

</div>

> [@redboyben](#):
>
> The quickest would be to sort your ingest by ascending time to get the earliest date of your data!  
> You can also delete it and recreate it if you want to set something different.

Clarifying for posterity that the retention period configured for audit logs is based on when the files are added to the dataset, _not_ the timestamp field in the data, so sorting by ascending time is of limited usefulness here (unless by “time” you mean file-added time as shown in the dataset’s “Details → Files” tab). However, you should be able to easily confirm the configured retention period for an audit log dataset by looking at the dataset’s “Details → Retention policies” tab.

 ![image](https://canada1.discourse-cdn.com/palantir/original/2X/6/6a7d34a51ce4bdbf82ec79643661d7abc078aec1.png)
