> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Logging Audit Retention Should Be At Least 90 Days

### More Info:

Audit logs should be retained for at least 90 days. Insufficient retention limits the ability to investigate security incidents that may not be detected immediately

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Here’s how to set OCI Logging retention to at least 90 days for Monitoring logs using the OCI Console:

        1. **Sign in & choose the correct compartment**
           * Log in to the OCI Console.
           * At the top-left, select the **Compartment** where your Monitoring logs are located.

        2. **Open Logging**
           * In the left-side menu, go to:\
             **Observability & Management → Logging → Log Groups**.

        3. **Select the relevant Log Group**
           * In your chosen compartment, click the **Log Group** that contains your Monitoring logs (for example, `monitoring-log-group`, or where you configured Monitoring service logs).

        4. **Open the Monitoring Log**
           * Inside the log group, go to the **Logs** tab.
           * Locate the **Monitoring** log (Type will usually be “Service” and Source something like `monitoring`).
           * Click the name of that log.

        5. **Edit the retention period**
           * On the log details page, click **Edit** (or **Edit Log**).
           * Find the **Retention period** setting.
           * Change it to **90 days** or higher (e.g., 90, 180, etc.).

        6. **Save the changes**
           * Click **Save changes**.
           * Confirm the update if prompted.

        7. **Repeat for other Monitoring logs / compartments**
           * If you have multiple Monitoring logs in other log groups or compartments, repeat the steps so that each relevant Monitoring log has a retention of **≥ 90 days**.

        This updates the retention for Monitoring logs in the OCI Logging service to meet the 90‑day requirement.
      </Accordion>

      <Accordion title="Using CLI">
        Here’s how to set **at least 90 days retention** for **OCI Logging (Monitoring logs)** using the **OCI CLI**.

        > Note: In OCI, retention is set on the **log group**, not the individual log. So you must update the log group where your Monitoring logs are stored.

        ***

        ### 1. Identify the Log Group for Monitoring Logs

        If you already know the log group OCID, skip to step 2.

        List log groups in the compartment where your Monitoring logs reside:

        ```bash theme={null}
        oci logging log-group list \
          --compartment-id <COMPARTMENT_OCID>
        ```

        Find the `id` of the log group that contains your Monitoring logs\
        (e.g., `id`: `"ocid1.loggroup.oc1...."`).

        If you need to confirm which logs are Monitoring logs in that group:

        ```bash theme={null}
        oci logging log list \
          --log-group-id <LOG_GROUP_OCID>
        ```

        Look for logs where `source_service` is `oci_monitoring` or similar.

        ***

        ### 2. Check Current Retention on the Log Group

        ```bash theme={null}
        oci logging log-group get \
          --log-group-id <LOG_GROUP_OCID>
        ```

        In the output, check the `retention-duration` (in days).

        ***

        ### 3. Update Retention to at Least 90 Days

        Set retention to 90 days (or higher if you prefer):

        ```bash theme={null}
        oci logging log-group update \
          --log-group-id <LOG_GROUP_OCID> \
          --retention-duration 90
        ```

        You can also use a higher value, e.g., `--retention-duration 180`.

        ***

        ### 4. Verify the Change

        ```bash theme={null}
        oci logging log-group get \
          --log-group-id <LOG_GROUP_OCID> \
          --query "data.retention-duration"
        ```

        Ensure the returned value is `>= 90`.

        ***

        ### If You Also Need Audit Log Retention (Root Tenancy)

        For **Audit** service retention at the tenancy level:

        ```bash theme={null}
        oci audit-configuration update \
          --compartment-id <TENANCY_OCID> \
          --retention-period-days 90
        ```

        Verify:

        ```bash theme={null}
        oci audit-configuration get \
          --compartment-id <TENANCY_OCID> \
          --query "data.retention-period-days"
        ```
      </Accordion>

      <Accordion title="Using Python">
        Below is how to remediate this with Python using the OCI SDK by **updating log retention to at least 90 days** for Monitoring-related logs in OCI Logging.

        ***

        ## 1. Prerequisites

        1. Install the SDK:

        ```bash theme={null}
        pip install oci
        ```

        2. Configure your OCI CLI credentials (if not already):

        ```bash theme={null}
        oci setup config
        ```

        This creates `~/.oci/config` with your tenancy, user OCID, key, etc.

        ***

        ## 2. Concept: What You Actually Change

        Retention is set **per log** in the Logging service.

        * Resource: `Log` (under a `LogGroup`)
        * Field: `retention_in_days`
        * API: `LoggingManagementClient.update_log`

        You need to:

        1. Find the right log group(s) and log(s) (e.g., logs for Monitoring / Audit).
        2. For each log, check `retention_in_days`.
        3. If \< 90, update it to 90 (or more).

        ***

        ## 3. Python Example: Set Retention for Monitoring Logs to ≥ 90 Days

        This script:

        * Uses your default OCI profile.
        * Works in one region (set in your config).
        * Searches all log groups in a compartment.
        * For each log where `source_service == "monitoring"` (i.e., Monitoring service logs), sets retention to 90 if it’s currently lower.

        ```python theme={null}
        import oci

        # ----------------------------
        # Configuration
        # ----------------------------
        CONFIG_PROFILE = "DEFAULT"      # or another profile name
        COMPARTMENT_OCID = "<your_compartment_ocid>"
        MIN_RETENTION_DAYS = 90

        # ----------------------------
        # Setup clients
        # ----------------------------
        config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE)
        logging_client = oci.logging.LoggingManagementClient(config)

        # ----------------------------
        # Helper: list all log groups in a compartment
        # ----------------------------
        def list_log_groups(compartment_id):
            log_groups = []
            list_call = logging_client.list_log_groups(
                compartment_id=compartment_id
            )
            log_groups.extend(list_call.data)

            while list_call.has_next_page:
                list_call = logging_client.list_log_groups(
                    compartment_id=compartment_id,
                    page=list_call.next_page
                )
                log_groups.extend(list_call.data)
            return log_groups

        # ----------------------------
        # Helper: list all logs in a log group
        # ----------------------------
        def list_logs(log_group_id):
            logs = []
            list_call = logging_client.list_logs(
                log_group_id=log_group_id
            )
            logs.extend(list_call.data)

            while list_call.has_next_page:
                list_call = logging_client.list_logs(
                    log_group_id=log_group_id,
                    page=list_call.next_page
                )
                logs.extend(list_call.data)
            return logs

        # ----------------------------
        # Main: update retention for Monitoring logs
        # ----------------------------
        def ensure_monitoring_logs_retention(compartment_id, min_days):
            log_groups = list_log_groups(compartment_id)
            print(f"Found {len(log_groups)} log groups")

            for lg in log_groups:
                print(f"\nChecking log group: {lg.display_name} ({lg.id})")
                logs = list_logs(lg.id)

                for log in logs:
                    # Filter to Monitoring service logs
                    # For service logs, source_service will be set to the OCI service, e.g., "monitoring"
                    source_service = getattr(log, "source_service", None)
                    if source_service is None or source_service.lower() != "monitoring":
                        continue

                    current_retention = log.retention_in_days
                    print(f"  Log: {log.display_name} ({log.id}) | current retention: {current_retention} days")

                    if current_retention is None or current_retention < min_days:
                        print(f"    -> Updating retention to {min_days} days")
                        update_details = oci.logging.models.UpdateLogDetails(
                            retention_in_days=min_days
                        )

                        response = logging_client.update_log(
                            log_group_id=lg.id,
                            log_id=log.id,
                            update_log_details=update_details
                        )
                        print(f"    Updated. New retention: {response.data.retention_in_days} days")
                    else:
                        print("    Retention already compliant, no change")

        if __name__ == "__main__":
            ensure_monitoring_logs_retention(COMPARTMENT_OCID, MIN_RETENTION_DAYS)
        ```

        ***

        ## 4. Adapting This for “Audit” Logs in Logging (If You’re Shipping Audit → Logging)

        If your organization forwards **Audit** events into Logging (e.g., via Service Connector):

        * Change the filter to match how you identify those logs, e.g.:
          * By `source_service == "audit"`, or
          * By `log_type == "SERVICE" and log.display_name` pattern, etc.

        Example filter tweak:

        ```python theme={null}
        # For Audit logs instead of Monitoring:
        if source_service is None or source_service.lower() != "audit":
            continue
        ```

        ***

        ## 5. If You Actually Meant Native OCI **Audit** Service Retention

        If the requirement is specifically “Audit logs retention ≥ 90 days” using the **Audit** service (not Logging), you must:

        * Use `oci.audit.AuditClient.update_configuration`.
        * Set `retention_period_days` in the Audit configuration for the tenancy/compartment.

        Minimal example:

        ```python theme={null}
        import oci

        CONFIG_PROFILE = "DEFAULT"
        COMPARTMENT_OCID = "<your_tenancy_or_compartment_ocid>"
        MIN_RETENTION_DAYS = 90

        config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE)
        audit_client = oci.audit.AuditClient(config)

        current_conf = audit_client.get_configuration(COMPARTMENT_OCID).data
        if current_conf.retention_period_days < MIN_RETENTION_DAYS:
            details = oci.audit.models.UpdateConfigurationDetails(
                retention_period_days=MIN_RETENTION_DAYS
            )
            resp = audit_client.update_configuration(
                compartment_id=COMPARTMENT_OCID,
                update_configuration_details=details
            )
            print("Updated Audit retention to:", resp.data.retention_period_days)
        else:
            print("Audit retention already compliant")
        ```

        ***

        If you clarify whether your “Audit” logs are:

        * native **Audit service** logs, or
        * logs in **Logging** sourced from Audit/Monitoring,

        I can narrow this down to exactly one final script for your setup.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Configure Audit log retention for the tenancy (or target compartment)
        resource "oci_audit_configuration" "audit_retention" {
          # Replace with the OCID of the tenancy or compartment whose Audit config you are managing.
          # For global Audit configuration, this is typically the tenancy OCID.
          compartment_id        = "OCID_OF_TENANCY_OR_TARGET_COMPARTMENT"

          # Set retention to at least 90 days, per the requirement.
          retention_period_days = 90
        }
        ```

        Changing `retention_period_days` does not force resource replacement; it updates in place.

        To verify, `terraform plan` should show the existing `retention_period_days` changing from its current value (e.g., 30) to `90`:

        ```text theme={null}
        ~ resource "oci_audit_configuration" "audit_retention" {
              retention_period_days = 30 -> 90
          }
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>