In this guide · 8 sections
- 01Which logs actually help after an incident
- 02What Cyber Essentials and the PDPA say about logs
- 03How long to keep logs: a practical schedule
- 04Default log retention in Microsoft 365, Google and Linux
- 05Protect logs from deletion and from prying eyes
- 06Storage cost: logs are cheaper than you think
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Keep sign-in, admin-action and web access logs at minimum. A practical default is about 90 days searchable plus 12 months archived, longer if a law or contract requires it. The PDPA sets no fixed period, so write your period down, restrict access and delete on schedule.
Which logs actually help after an incident
Not every log line is worth keeping. After a hacked website, a stolen password or a deleted folder, the questions are almost always the same: who got in, from where, what did they change, and is it still happening. These are the logs that answer them.
| Log | Where it lives | What it answers |
|---|---|---|
| Sign-in and authentication | SSH auth log, WordPress or app login records, Microsoft 365 or Google sign-in logs | Who logged in, from which IP address, and failed attempts before success |
| Admin and change actions | Cloud console audit log, CMS activity log, database admin tools | Who created users, changed settings, installed plugins or deleted data |
| Web server access logs | Nginx or Apache access log, CDN or firewall logs | Which pages and files were requested, including attacks on login and upload forms |
| Application errors | App and PHP error logs | Crashes and odd behaviour that often show up before a break-in |
| Security tool logs | Firewall, fail2ban, malware scanner, endpoint protection | What was blocked, what was found, and when |
Logs from your cloud services matter as much as logs on the server itself. A business email account is a more common way in than SSH, so make sure you can read the sign-in and audit logs in Microsoft 365 or Google Workspace before you need them.
What Cyber Essentials and the PDPA say about logs
CSA's Cyber Essentials (2025) certification document (clause A.6.4) says logging shall be enabled for audit logs of events that help detect, understand or recover from an attack, giving user log-ins and file access as examples. It also says organisations shall enable audit logs for cloud environments and AI tools where supported, and should enable system, application, security tool and proxy logs. It does not set a retention period.
The PDPA's Retention Limitation Obligation (section 25) works the other way. PDPC's advisory guidelines, chapter 18 say there is no fixed duration: you may keep personal data while the purpose it was collected for is still served, or while it is needed for legal or business reasons, but not 'just in case'. Logs contain personal data such as email addresses, usernames and IP addresses linked to accounts, so they fall under the same rule.
How long to keep logs: a practical schedule
Attackers are often inside an account for weeks before anyone notices, so a few days of logs is rarely enough. On the other hand, years of raw web logs cost money to store and add PDPA exposure. A two-tier approach works for most small businesses: recent logs searchable, older logs compressed in cheaper storage, then deleted.
| Log type | Searchable | Archived | Notes |
|---|---|---|---|
| Sign-in and admin actions | 90 days | 12 months | Most useful in an investigation; small in size |
| Web server access logs | 30 to 90 days | Up to 12 months | Large; strip or shorten query strings that contain personal data |
| App and error logs | 30 days | Optional | Mainly for fixing bugs |
| Security tool alerts | 90 days | 12 months | Keep together with the incident record if one is opened |
If an incident or a dispute starts, put a hold on the relevant logs so the normal deletion does not remove evidence. Our incident response plan guide covers that step, and the data retention policy template shows how to write the periods down.
Default log retention in Microsoft 365, Google and Linux
Check what your platforms keep before you build anything. Many of the logs you need already exist, but only for a limited time.
- Microsoft 365: Audit (Standard) keeps audit records for 180 days (raised from 90 days for logs created from 17 October 2023). Keeping them up to a year needs Audit (Premium) licensing.
- Google Workspace: Google's data retention table lists 6 months for admin, login, Drive and most other log events, and administrators cannot change that period.
- Linux servers: logs under /var/log are rotated by logrotate. Many distributions keep only a few weeks by default, so check /etc/logrotate.conf and the files in /etc/logrotate.d before relying on them.
- Hosting panels and CDNs: shared hosting and CDN plans often keep raw access logs for days, not months. Download or forward them if you need longer.
If you need logs beyond these windows, export them on a schedule to storage you control.
Protect logs from deletion and from prying eyes
A careful attacker deletes or edits local logs. Forwarding them to a separate system as they are written means the copy survives even if the server is wiped. That can be a hosted log service, a cloud storage bucket with versioning or object lock, or a small central log server.
Log storage checklist
Logs are only useful if someone looks at them. At minimum, set alerts for new admin accounts, logins from new countries and bursts of failed logins. Our server monitoring and alerts guide covers which alerts are worth setting up.
Storage cost: logs are cheaper than you think
Text logs compress well, and sign-in and admin logs for a small business are tiny. Web access logs are the bulk: a busy site can produce a large file each day, which is why the schedule above keeps them searchable for a shorter time. Compressing archived logs and moving them to low-cost object storage usually keeps the bill small.
Do it yourself or get help?
If you run one server and are comfortable on the command line, you can set log forwarding, rotation and a few alerts in an afternoon. Write the periods into your retention policy and test that you can actually search last month's sign-ins.
Our Server Protection Care (S$149 per server per month) includes monthly updates, protection checks, a restore test and a plain-English report. If you want sign-in, MFA and backup status from several tools on one screen, a Custom Security Dashboard starts from S$1,900. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send the brief in writing and follow progress on your order page.
Frequently asked questions
There is no single legal period in Singapore. A practical default is about 90 days of searchable logs and 12 months of archived sign-in and admin logs, because attackers are often inside for weeks before anyone notices. Keep longer if a contract, sector rule or open investigation needs it, and write the periods down.
Often, yes. Logs record usernames, email addresses and IP addresses linked to accounts, which can identify people. That means the PDPA's protection and retention limitation obligations apply: keep logs for a stated purpose such as security, restrict who can read them and delete them when the period ends.
Cyber Essentials (2025) requires audit logs of events that help detect, understand or recover from an attack, such as user log-ins and file access, and audit logs in cloud services and AI tools where supported. It does not set a retention period, so you choose one that makes the logs useful and document it.
Microsoft Purview Audit (Standard) keeps audit records for 180 days for logs created from 17 October 2023. Longer retention, up to a year or more, needs Audit (Premium) licensing. If you need records beyond 180 days without upgrading, export them on a schedule to storage you control.
Not only on the same server. Anyone who gains admin access can delete or edit local logs to hide what they did. Forward logs as they are written to a separate store, ideally with versioning or write-once protection, and limit who can read or delete them there.