With the new Data Retention settings introduced in 26.03, my assumption was that once enabled, it would clean up old logs and retain only those from the last X number of days. This does not appear to be the case, as I still have several million SIEM records dating back to the first day the system was deployed over two years ago. Is this an issue unique to my deployment? Is this a bug? Or is this by deign?
I was informed it cleans up 10,000 log entries/day by default. There is a way to increase this number, but it is not one mass dump of old logs as I’d imagined.