Question

A financial services company runs 60 microservices on Azure Kubernetes Service. Their security team requires that authentication and audit events be retained for 3 years and be fully searchable with KQL and included in analytics-based alerts. Meanwhile, the platform team generates roughly 4 TB per day of high-volume debug and verbose application traces that are rarely queried but must be available for interactive investigation for up to 30 days when incidents occur. Management wants to minimize Log Analytics ingestion and retention costs while meeting both requirements. What should you recommend?

Accepted Answer

Send the audit and authentication events to Analytics tables with long-term (archive) retention configured to 3 years, and configure the high-volume trace tables to use the Basic logs (low-cost) table plan with a 30-day retention.

Answer

Ingest all logs into a single Log Analytics workspace using the Analytics table plan, and configure a 3-year retention policy for the entire workspace.

Answer

Export all logs directly to an immutable storage account and query them with Azure Data Explorer only when incidents occur.

Answer

Send all logs to Basic logs tables to minimize ingestion cost, and enable a 3-year retention policy on the audit tables.