Log Retention Evidence Check
Compare caller-supplied expected and observed records for log retention evidence check.
Description
Log-retention evidence connects a stated policy with recorded storage and deletion practices.
Log-retention evidence connects a stated policy with recorded storage and deletion practices. Labels identify which evidence categories are represented.1
Compare caller-supplied expected and observed records for log retention evidence check.
When to use Log Retention Evidence Check
Use this tool to compare caller-supplied expected and observed records for log retention evidence check.
Prepare the documented facts, aligned totals or expected/observed evidence labels requested. Choose applicable requirements and thresholds separately before interpreting a planning screen.
How to use Log Retention Evidence Check and understand its results
- Prepare the documented facts, aligned totals or expected/observed evidence labels requested. Choose applicable requirements and thresholds separately before interpreting a planning screen.
- Enter requiredEvidence, availableEvidence using the field table and calculation rules, then run the tool.
- Read coveragePercent, matched, missing, unexpected. The explanation below defines the units, signs, ordering and any flags or placeholder values.
- If the tool reports an input issue, correct the values and run it again. Apply the stated assumptions when interpreting a successfully returned result.
| Input field | Meaning | Value type; see rules below | Requirement |
|---|---|---|---|
| requiredEvidence | Required retention evidence | list of string | Required |
| availableEvidence | Available evidence | list of string | Required |
Enter requiredEvidence as the nonempty expected list and availableEvidence as observations, which may be empty. Trim entries, compare case-insensitively using en-US lowercase and collapse duplicates. Return matched/missing expected labels and unexpected observed labels. Output follows first occurrence order with the last duplicate’s trimmed spelling.
coverage%=100matchedUnique/expectedUnique Units, indexing, boundary conditions and exceptional cases are defined in the calculation rules above.
| Output field | Meaning | Value type |
|---|---|---|
| coveragePercent | Coverage (%) | number; minimum: 0; maximum: 100 |
| matched | Matched items | list of string |
| missing | Missing items | list of string |
| unexpected | Unexpected items | list of string |
{
"input": {
"requiredEvidence": [
"policy",
"sample logs",
"deletion proof"
],
"availableEvidence": [
"policy",
"sample logs"
]
},
"output": {
"coveragePercent": 66.66666666666666,
"matched": [
"policy",
"sample logs"
],
"missing": [
"deletion proof"
],
"unexpected": []
}
}Limitations and assumptions
No retention duration, logs or deletion operations are tested. Blank entries are errors; requirements are entirely caller-supplied and items have equal weight.
Numeric inputs, where present, must be finite. Follow the calculation-specific rules for overflow, underflow and exceptional cases. Lists are limited to 100,000 entries; the rules above may require smaller limits. Missing required fields, extra fields, wrong value types and violations of the calculation rules are input errors.
Alternative or Complementary methods
Use PAM Evidence Coverage: Audit privileged-access-management evidence. For a complementary task, use Continuous-Close Freshness: Measure continuous-close data freshness and pipeline-check status.
References
-
Log Retention Evidence Check — tool.io
Similar or alternative tools
- PAM Evidence Coverage
Audit privileged-access-management evidence.
- Continuous-Close Freshness
Measure continuous-close data freshness and pipeline-check status.