Skip to main content

CSE Data Retention

This topic lists the CSE data that is retained on the Sumo Logic platform and in CSE, and the retention period for each type of data.

Sumo Logic platform

This table lists where, and for how long, different types of CSE data are retained on the Sumo Logic platform.

DataLocationRetention
Raw logsRaw logs reside in your Default Partition in Sumo LogicThe retention period defined for your Default Partition. This period is customer-configurable.
CSE RecordsRecords (normalized logs) are stored in the partitions whose names begin with the string sec_records. There is one partition for each Record type.

There is no additional charge for storage of Records.
90 days
CSE SignalsStored in the sec_signal partition.

There is no additional charge for storage of Signals.
2 years
CSE InsightsThe sumologic_system_events partition contains Insights and Insight-related events that result from system actions.
The sumologic_audit_events partition contains Insights and Insight-related events that result from user actions.

There is a charge for storage of Insight-related data in the audit indexes. Note however the volume of data is typically very low compared to log ingestion levels.
By default, these partitions have a retention period of 30 days. This period is customer-configurable.

CSE

  • Insights and Signals that are attached to Insights are retained in CSE indefinitely.
  • Signals that are not attached to Insights are retained in CSE:
    • For 90 days if suppressed. (As of October 1, 2022, this will change to 30 days.)
    • For 365 days if unsuppressed.
Sumo Logic YouTubeSumo Logic Twitter
Legal
Privacy Statement
Terms of Use

Copyright © 2022 by Sumo Logic, Inc.