Use a data policy to control how long to keep compressed and indexed logs. When ADOMs are enabled, you can specify settings for each ADOM and the settings apply to all devices in that ADOM. When ADOMs are disabled, settings apply to all managed devices.
A data policy specifies:
- How long to keep Analytics logs indexed in the database
When the specified length of time in the data policy expires, logs are automatically purged from the database but remain compressed in a log file on the FortiAnalyzer disks.
- How long to keep Archive logs on the FortiAnalyzer disks
When the specified length of time in the data policy expires, Archive logs are deleted from the FortiAnalyzer disks.
See also Log storage policy.