Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How long are WAF logs kept?
Short answer
There is no separate retention setting for Event Logs; the device-wide Disk Management rules are applied and Auto Disk Cleanup also deletes WAF logs. The cleanup runs every day at 02:00 with two limits: when % Limit for Auto Disk Cleanup (default 90%, range 70–95) is exceeded, monthly files are deleted starting from the oldest month until space is freed; months older than the Month Limit for Auto Disk Cleanup value (default 12, at least 1) are deleted. The deleted types, with their names on the File Management tab, are WAF Logs (including the hourly summaries that WAF Reports read), Learning, Threat Event Logs, AGS Audit Logs, Report Logs and Diagnostic Logs (debug & HTTP); Stats (Dashboard and Home charts), Report Summaries and OLD Stat Summaries are preserved. The AI Learning and Teacher history and the records for reverting the learning are not within the scope of this cleanup. In a cluster setup, each device cleans only its own disk; the File Management tab shows the sizes by month and allows the files of a month to be deleted manually. If long-term retention is needed, the records are sent to the SIEM with the Logs profile; the copy in the SIEM is not affected by the cleanup of the device.
How Does It Work?
| Data | Retention |
|---|---|
| Event Logs records (WAF Logs in File Management) | One file per vService per hour; files older than two hours are compressed and are decompressed when read. The hourly summaries used by WAF Report and Global WAF Report are also of the same type. Deletion depends on the Auto Disk Cleanup rules |
| Learning log (Learning in File Management; the data that Analysis & Learning reads) | Deleted with the same rules |
| Dashboard and Home statistics (Stats in File Management) | Preserved in the automatic cleanup; kept for up to 10 years, with the resolution becoming coarser as the data ages (Dashboard) |
| WAF Report and Global WAF Report outputs | Not stored on the device; displayed on the tab in which they are generated, or downloaded (WAF Report) |
| Notification Logs | Kept separately; cannot be deleted from the screen |
| Lines sent to the SIEM | Independent of the cleanup of the device; the retention period is determined in the SIEM (compliance requirements) |
Example: while Month Limit for Auto Disk Cleanup = 12, the nightly cleanup in October deletes the files of September of the previous year and of older months. If the disk usage exceeds 90%, the oldest months are deleted without waiting for this limit, until the usage falls below the limit.
Does Auto Disk Cleanup Also Delete WAF Logs?
Yes. The cleanup configured with Settings → Device Management → Disk Management → Disk State → Auto Disk Cleanup deletes all file types except the three preserved types. The types, with their names on the File Management tab:
| Type in File Management | Auto Disk Cleanup | Content |
|---|---|---|
| WAF Logs | Deleted | Event Logs and Global WAF Event Log records; including the hourly summaries that WAF Report and Global WAF Report read |
| Learning | Deleted | The learning log that Analysis & Learning reads |
| Threat Event Logs | Deleted | L7 DDoS & Threat Protection event logs |
| AGS Audit Logs | Deleted | AGS audit records |
| Report Logs | Deleted | Hourly raw traffic records kept for the Report screen on the Load Balancer side in vServices that have a Reports profile assigned; they are unrelated to WAF records |
| Diagnostic Logs (debug & HTTP) | Deleted | Debug and HTTP diagnostic logs |
| OLD Stats, OLD Compressed Stats, Obsolete Stats | Deleted | Statistics files in the old format and no longer used |
| Stats | Preserved | Statistics of the Dashboard and Home charts |
| Report Summaries | Preserved | Hourly report summaries produced from the Report Logs records |
| OLD Stat Summaries | Preserved | Old statistics summaries |
- The Event Logs, Global WAF Event Log, WAF Report and Global WAF Report data of a deleted month does not come back; the Dashboard charts of that period, on the other hand, continue to appear because Stats is preserved.
- The AI Learning and Teacher history and the learning records used for reverting the learning (Revert learning) are kept separately; Auto Disk Cleanup does not touch them.
- % Limit for Auto Disk Cleanup takes into account only the usage of the data disk on which the records are kept; when the limit is exceeded, the current month can also be deleted.
- Files deleted in the automatic cleanup are written to the user logs with the
[Auto disk cleanup (>N month)]or[Auto disk cleanup (>N%)]label.
Changing the Retention Period
In the editing tab opened with the Auto Disk Cleanup button on the Disk State tab of the Settings → Device Management → Disk Management screen, the two limits are changed; the rule is applied device-wide to all log types. Details and steps: How long are logs kept on the device?
- To delete the files of a month without waiting, the month is selected on the File Management tab and deleted; the detail of the monthly sizes is seen with View Usage Details.
- If longer retention is needed, the records are sent to the SIEM instead of the month limit being increased; when the disk fills up, the usage limit comes into play before the month limit (How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?).
Common Misconceptions
- "WAF logs have their own retention period." There is no separate setting for Event Logs; the device-wide Auto Disk Cleanup rules are applied.
- "When records are deleted, the Dashboard charts are lost too." Dashboard statistics are kept separately and are preserved in the automatic cleanup.
- "In a cluster, a manual deletion made on one device is also applied to the peer device." Each device manages its own disk (In a cluster, which device do WAF logs come from; how do I distinguish the device in Event Logs?).
How it is done in the documentation
