Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
An archive can retain files for 24 months and still miss large stretches of the days they are supposed to cover. In a September 28, 2026, first-person account, אחיה כהן found that the archive job’s nightly pickup ran less often than the local auditd log ring could preserve busy servers’ records. Across 29 days, the author reported mean daily archive coverage as low as 33.6% on a database server. That is one operator’s measurement, not a general rate—but it illustrates why retention age alone does not prove completeness.
How a 24-month archive can miss most of a day
The failure was a mismatch between two clocks: how quickly auditd generated records and rotated local files, and how often the archive job collected those files. The author described eight Ubuntu 24.04 servers running auditd 3.1.2, with 22–25 rules on each. The archive ran nightly after forcing log rotation. Locally, the described ring consisted of five 8 MB files with max_log_file_action = ROTATE.
With rotation, new files take the place of older ones as the configured set cycles. Ubuntu’s auditd.conf(5) documentation says num_logs controls how many rotated files are kept when the action is rotate. If the ring cycles through its files before the archive job collects them, records in the oldest file can be removed first. A long-lived archive directory does not bring those missing records back.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The practical comparison is therefore between the hours of history actually available in the local ring on a busy host and the time until the next successful archive pickup. A configured retention period answers how long collected files may be kept; it does not answer whether every interval was collected.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
What the reported measurements showed
Across 29 days, Cohen reported the following mean daily archive coverage. These are measurements from the author’s environment, not an independently verified benchmark or a representative sample of Ubuntu servers.
| Server | Reported mean daily archive coverage |
|---|---|
| Database | 33.6% |
| Website | 52.6% |
| Voice | 75.0% |
| Chatwoot | 94.0% |
For the database server, the author also reported that only 234 of the most recent 696 hours were present in the archive. The post’s comparison omitted two client-dedicated servers, so its figures should not be read as a complete accounting of every machine in that environment.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Why the database ring cycled so quickly
The author traced high event volume to broad file watches and frequent writes. In the database server’s reported counts, 35,082 of 35,659 rule-matching events were attributed to postgres. The post also describes rsync deployment activity as another source of frequent events. These details point to a key operational variable: the effective lifetime of a log ring depends on the host’s event rate, not just its nominal file count and size.
One overnight interval further illustrates the activity involved: the author reported 19,177 SYSCALL events in audit.log and 18,912 in auth.log. Those counts belong to the specified interval in the original account; they are not expected rates for other systems.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How to check whether your archive has gaps
Measure the time your local files actually cover on the busiest machine, then compare that span with the interval between archive pickups. The author’s proposed measurement infers a file’s interval using its first record timestamp and its modification time. That method assumes the file is not touched after creation; a later write or other modification can make the modification time a misleading endpoint.
- Identify the active configuration. Check the installed host’s auditd configuration and local man pages for
max_log_file,max_log_file_action, andnum_logs. The size threshold, action on reaching it, and number of retained rotated logs determine local behavior. - Measure the ring on the busiest host. Inspect the rotated files and determine the earliest and latest record times they contain. Do not infer capacity from configured megabytes alone: event volume varies, and a burst can shorten the available history.
- Compare coverage with the pickup interval. Include delayed or failed archive runs, not only the intended schedule. If local files cover fewer hours than the time between pickups, the ring can cycle before collection.
- Verify archived intervals. Check that the archive contains records spanning the periods expected from each pickup. A successful job status or a directory full of old files does not establish continuous coverage.
Cohen’s memorable test was: “If the second command shows fewer hours than the gap between your archive runs, your retention policy exists only in a document.” The useful principle is the comparison itself; the commands and file assumptions must fit the host’s auditd version and setup.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Changing the pickup schedule and rotation strategy
Collect rotated files more often
The author added a locked quarter-hourly job to archive files that had already rotated by size, while retaining the nightly forced rotation. This shortened the pickup gap in that environment, but it did not guarantee completeness: the author noted that bursts larger than roughly 32 MB in fifteen minutes could still exceed the available window. A quarter-hour schedule is not a universal safe setting; size the interval against measured event volume and bursts on each system.
Understand size-based and time-based rotation
The described setup rotated on file size, with the nightly job also forcing a rotation. Ubuntu’s current auditd.cron(5) documentation describes time-based rotation as an alternative to the default size-based approach. Examples and behavior can vary by package version, so check the documentation installed on the target host before adopting a configuration. Time-based rotation can make files easier to associate with time periods, but it does not by itself ensure that files are archived before they disappear or that a burst fits the local storage window.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Choose bounded rotation or continued accumulation deliberately
Ubuntu documents keep_logs as similar to rotate, but without the num_logs limit. That avoids cycling through a bounded set of rotated files, but accumulated logs still consume disk space. Plan capacity and the response to a full disk rather than treating indefinite local retention as free protection. Ubuntu’s auditd.conf(5) documentation covers the rotation and disk-space settings; the right balance depends on the deployment.
Why a second copy may not be a complete backup
The author reported that a syslog plugin also forwarded records into auth.log, making that file a more complete copy during the measured period. The same account reported message loss in forwarding and journald rate limiting. Forwarding may provide another useful record stream, but it is not a guaranteed lossless replacement for collecting and verifying the audit files.
Ubuntu documents that sending SIGUSR1 causes auditd to rotate logs immediately, with the result governed by max_log_file_action; see auditd(8). A forced rotation is an action, not proof that an archive pickup succeeded. Check the resulting files and their coverage.
Retention obligations need separate verification
Cohen’s post says Israeli data security regulations require keeping access logs for 24 months. The account does not identify the regulation or specify which entities, logs, or circumstances it covers, and the applicable legal obligation is not established here. Treat the statement as the author’s claim, not general legal guidance; organizations should verify requirements applicable to their own circumstances.
Whether the retention target is a legal obligation or an internal policy, keep two checks distinct: how long archived material is retained, and whether the archive contains the records for every intended interval. The first cannot substitute for the second.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
