Log Retention Policies — Defining and Implementing Log Retention

// Retention policy manager
class RetentionPolicyManager {
  constructor() {
    this.policies = {
      'debug': { retention: '24h', compress: false, priority: 'low' },
      'info': { retention: '7d', compress: true, priority: 'low' },
      'warn': { retention: '30d', compress: true, priority: 'medium' },
      'error': { retention: '90d', compress: false, priority: 'high' },
      'audit': { retention: '365d', compress: false, priority: 'critical', immutable: true },
      'security': { retention: '365d', compress: false, priority: 'critical', immutable: true }
    };
  }

  async applyRetention(service, date) {
    const prefix = `logs/${service}/${date}`;
    const objects = await s3.listObjects({ Bucket: 'scanapp-logs', Prefix: prefix });

    for (const obj of objects.Contents || []) {
      const metadata = await s3.headObject({ Bucket: 'scanapp-logs', Key: obj.Key });
      const logType = metadata.Metadata?.log_type || 'info';
      const policy = this.policies[logType] || this.policies.info;

      const logDate = new Date(date);
      const retentionDays = this.parseRetention(policy.retention);
      const cutoff = new Date();
      cutoff.setDate(cutoff.getDate() - retentionDays);

      if (logDate < cutoff) {
        if (policy.immutable) {
          // Move to immutable archive
          await this.archiveObject(obj.Key);
        } else {
          await s3.deleteObject({ Bucket: 'scanapp-logs', Key: obj.Key });
        }
      }
    }
  }

  parseRetention(retention) {
    const match = retention.match(/(\d+)([dhmy])/);
    if (!match) return 7;
    const value = parseInt(match[1]);
    switch (match[2]) {
      case 'h': return value / 24;
      case 'd': return value;
      case 'm': return value * 30;
      case 'y': return value * 365;
      default: return 7;
    }
  }
}

// Automated retention job
cron.schedule('0 2 * * *', async () => {
  const yesterday = new Date(Date.now() - 86400000).toISOString().slice(0, 10);
  await retentionManager.applyRetention('scan-api', yesterday);
  await retentionManager.applyRetention('scan-worker', yesterday);
  logger.info(`Retention policy applied for ${yesterday}`);
});