Azure Log Analytics Excessive Retention
What does ZopNight detect here?
Log Analytics workspaces keeping interactive retention beyond 90 days are flagged to trim back to the 90-day baseline. Savings take the workspace's actual billed retention surcharge and remove its (retentionDays − 90)/(retentionDays − 31) share; without that billed surcharge from Cost Management the rule abstains.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1372 |
| Category | rightsizing |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | log_analytics_retention.go |
Where it applies
Retention days and the billed retention surcharge
- Metadata retentionInDays (authoritative properties.retentionInDays from Resource Graph): fires only when > 90; malformed/absent abstains. The dead retention_excessive=true Tag fallback (no producer) is removed.
- Metadata log_analytics_retention_cost_usd: the workspace’s actual billed data-retention surcharge (USD/month), harvested by the discoverer producer backend/discoverer/internal/provider/azure/log_analytics_retention_cost.go from Azure Cost Management (the retention meters only, namely Pay-as-you-go Data Retention/Analytics Logs Retention/Data Archive/Long-term Retention/Standard Data Retention, grouped by ResourceId + Meter so they are isolated from ingestion). Stamped only when > 0. This is the AWS RC-178 cross_region_transfer_cost_usd analogue.
- PricingAware (workspace total cost; the CurrentCost basis and savings cap, not the savings basis)
Trimming the tail beyond the 90-day baseline
the saving is the portion of the real billed data-retention surcharge removed by trimming interactive retention to the 90-day baseline. Retention is billed for data kept beyond the included 31-day period, so the billable window is (retentionDays − 31) and trimming to 90 removes its (retentionDays − 90) tail: savingsUSD = log_analytics_retention_cost_usd × (retentionDays − 90) / (retentionDays − 31) (capped at the workspace cost). We do not estimate retained-GB from ingestion (the Azure Monitor Usage metric is ingested bytes, the wrong axis; Microsoft.OperationalInsights/workspaces publishes no retained/stored-GB metric). When the billed retention surcharge is absent (no Cost Management access, or the workspace has no billed retention) the rule abstains (returns nil), never a fabricated or $0 saving. IAM: reuses Microsoft.CostManagement/query/read (Cost Management Reader), now declared under both the cost and discovery features.
Where to change the retention setting
- Go to Azure Portal → Log Analytics workspace → Usage and estimated costs → Data Retention