TechKnowSurge
NIST 800-53 AU-11 NIST 800-53 AU-4 CompTIA Security+ 4.4 ISC2 CISSP 2.5 ISC2 CISSP 2.4
TechKnowSurge Catalog Interactives Log Rotation, Archiving or Disposal?
InteractiveSecurityFree

Log Rotation, Archiving or Disposal?

Each card is a log housekeeping task. Rotation, archiving or disposal?

⚑ Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

Logs pile up. Too many can bog systems down and fill storage, and different systems keep them differently: forever, up to a number of records, for a set time, or up to a size limit. Log rotation cycles old logs out of the live system to make room for new ones. In the lesson, the ELK log aggregation could only hold a few months, so the oldest logs were cycled out. Log archiving moves older logs to another location so they are kept for as long as a rule requires. The lesson had to keep a year for compliance, so old logs went to separate storage, where they could be restored to research an incident. Log disposal gets rid of logs because keeping them is now a liability. Many treat IP addresses as personally identifiable information, and PII should not be kept longer than it is needed, so those logs are deleted once their period is over. The reason tells you which: room in the live system, a requirement to keep, or a duty not to keep.

What you'll learn

Aligned to

NIST 800-53
AU-11 Audit Record Retention
AU-4 Audit Log Storage Capacity
CompTIA Security+
4.4 Explain security alerting and monitoring concepts and tools.
ISC2 CISSP
2.5 Ensure appropriate asset retention
2.4 Manage data lifecycle

Key terms

Log Rotation
The process of cycling out old log files to make room for new ones, preventing systems from becoming overloaded with log data.
Log Archiving
The practice of moving older log files out of active systems into separate storage to meet retention requirements while freeing operational capacity.
Log Disposal
The deliberate deletion or destruction of log data after its required retention period has ended, particularly to remove sensitive information such as PII.
Personally Identifiable Information
PII
Personally Identifiable Information is any data that can be used alone or in combination to identify, contact, or locate an individual, requiring protection under privacy laws and organizational security policies.

Topics

Log Management Data Retention Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →