How long are logs kept on the device?

Short answer

There is no retention period set in days for Load Balancer logs; each source has its own size or record ceiling (screen structure). HTTP Logs are kept with a disk budget of 256 MB per vService and Debug Mode Logs with 128 MB, and when the budget is full, the oldest records are deleted; for this reason, the period covered varies according to the traffic density. TCP Logs keep at most 1,024 connection records and each record drops after 24 hours; vService Sessions, on the other hand, shows only the connections open at that moment. For long-term retention, HTTP and TCP records are sent to a log server with a Logs profile; Debug records are not sent out and are downloaded with Export on the screen when needed.

How Does It Work?

Each log source on the device is kept in its own store and is limited not by time but by size or record count; when the limit is reached, the oldest records are deleted. For this reason, how long a record can be seen is determined by the traffic density of the vService. Permanent and long-term retention is done not on the device but on the log server.

Retention by Source in TR7

Source	Ceiling	When full	Sending to the log server
HTTP Logs	256 MB per vService	The oldest log file is deleted; the viewable history varies between half and all of the budget	Yes (with a Logs profile)
Debug Mode Logs	128 MB per vService	The oldest log file is deleted	No
TCP Logs	1,024 connection records, 24 hours per record	The expired or the oldest record drops	Yes (with a Logs profile)
vService Sessions	Only open connections	Leaves the list when the connection closes	No

• HTTP logs and TCP logs are kept only while the LOG option of the vService is on; if LOG is off, no record is created on the device either. Debug Mode Logs are written only in an HTTP vService, while the vService is in Debug Mode.
• On the Debug Mode Logs and HTTP logs screens, at most 50000 lines are fetched at a time (Line Limit, default value 1000).
• Since the budgets work on size, 256 MB can cover a few hours on a busy vService and days on a low-traffic vService.
• Auto Disk Cleanup on the Settings → Device Management → Disk Management screen manages the overall fullness of the disk; in practice, the lifetime of HTTP and Debug logs is determined by the vService budget.

Long-Term Retention

1. With Load Balancer → Profiles → Logs → Add, a profile is created in which the address of the log server is entered in the Log Addresses field.
2. The vService is edited; in the Details panel, LOG is checked, this profile is selected in the Log profile field, and it is saved with Save. The built-in Stream log profile does not send to a log server.
3. The retention period and integrity are managed on the log server (compliance requirements).

Step by step: How do I send logs to a SIEM (Syslog)?

Common Misconceptions

• "The retention period is set in days." There is no retention setting in days in the interface; the ceiling is size or record count.
• "The Stream log profile sends logs out." Stream log only turns on the HTTP logs and TCP logs records on the device (default behavior).
• "Debug records are kept on the log server." Debug records are not sent out; when needed, they are downloaded with Export.

How it is done in the documentation

• Logs & Tracking · Screen Structure
• TCP Logs
• Logs profile · The Default Logs Profile Behavior
• Disk Management · Auto Disk Cleanup

Related questions

• How do I send logs to a SIEM (Syslog)?
• What is the difference between HTTP logs and TCP logs?
• How do I reduce log volume (silencing health check and static file logs)?