Retention for log files and audit logs

[Forza]

Is there a way to define the maximum retention on audit logs (the audit plugin in XOA) and the general XOA and XCP-ng application logs?

[olivierlambert]

Hi,

That's 2 very different things. Ping @julien-f for audit logs (or @Bastien-Nollet if he's around). For XO logs, same people to ping. For XCP-ng log rotation, it's another completely different story. Have you took a look at https://docs.xcp-ng.org/guides/logs/#logrotate?

[Forza]

@olivierlambert thanks! Logrotate seems easy enough to understand and adjust if needed. It's the audit and XOA logs that I need help understanding.

[Bastien Nollet]

Hi @Forza,

This is not possible at the moment. The XO log retention is set to 20,000 entries.

About audit logs, we have a task planned for the following months to try to add retention configuration. It's a bit complicated as deleting old audit logs interferes with audit log chain verification, so I don't think we can expect this feature to be released before a few months.

[Forza]

@Bastien-Nollet Thanks for checking. At least I know it is set to 20000 entries at the moment. Thank you.

[eveane]

I would like to suggest to configure a remote syslog server.

it centralizes all the log s and give you full control over the retention.

It would also avoid situation where a disk full would impact your logging as well XCP-ng or XOA host operations.

For your XCP-NG host go to you POOl, select Advanced tab and configure the Remote syslog host section to point to your syslog server.

For XOA, you can follow the instruction here :
https://docs.xen-orchestra.com/backups#send-xo-logs-to-an-external-syslog-server