Evidence Retention
"What happened Saturday night?" asked on Monday should be answerable at evidence granularity: the actual log lines and spans, not only the metric shapes. InfraSage keeps raw telemetry in value tiers rather than one blanket window, so the data that matters for postmortems survives without paying to archive a healthy firehose.
The tiers
| Tier | What lands there | Retention | How |
|---|---|---|---|
| Aggregates | Per-minute metric rollups (the detection substrate) | 365 days | Always on |
| Incident evidence vault | ±35 minutes of a service's raw logs + traces around every new alert | 90 days | Copied automatically the moment an alert fires |
| Error tier | Every error/fatal log line and every span slower than 1 s | 30 days | Streams continuously |
| Transit buffer | The full raw firehose | 24 hours | The working window for live investigation |
The vault is bounded by incident count, not traffic volume (a few megabytes per incident), and errors are typically 1-5% of log volume. You get a ~90-day evidence window for the data anyone actually revisits, at a small multiple of the transit buffer's footprint.
What this means in practice
- Explore and RCA's log/trace tools see the full firehose for the last 24 hours.
- A postmortem written days later still has the incident's raw evidence: the vault copy is keyed by alert id and service, captured before the transit TTL could touch it.
- Error lines and slow spans are searchable for a month regardless of whether they alerted.
Bring-your-own-stack tenants
If you run in federated mode (metrics pulled from your Prometheus, evidence read from your Loki/Tempo at question time), none of this applies: your stack is the archive, with whatever retention you already give it. InfraSage stores aggregates only, so the custody posture stays exactly as documented in Federated Telemetry.