You can choose to retain audit logs depending on size, retention period, or both. The audit log retention policy (by size or retention period) is enforced every 10 minutes starting from system startup.

Audit log retention by size is approximate:

• If an audit is added to the log during this enforcement period, the audit log size may increase temporarily.

• If an audit is in process when the enforced size is reached, the system retains that audit in the log and deletes the rest.