Description

Ensure logs from the database, Auth, Storage, Edge Functions, and API are kept long enough to meet the organization's security, compliance, and troubleshooting needs. If the plan's built-in retention is too short, logs should be sent to an external system using Log Drains.

Rationale

Logs are needed to investigate security incidents, but incidents are often discovered days or weeks after they happen. If logs are deleted too soon, there may be no record of what an attacker did. Built-in retention depends on the plan, so projects that need longer history should send logs to their own storage or monitoring platform.

Impact

  • Keeps logs available for investigations and audits

  • Helps meet compliance retention requirements

  • Longer retention may need a plan upgrade or Log Drains

Default Value

Log retention depends on the plan: 1 day on Free, 7 days on Pro, 28 days on Team, and 90 days on Enterprise. Log Drains are available on Pro, Team, and Enterprise plans.

Pre-Requisites

  • Organization Owner role for plan changes

  • Project Owner or Admin role for Log Drains

  • An external log destination, such as S3 or Datadog

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your organization.

  3. Open Organization Settings and select Billing, and check the current plan's log retention.

  4. Open the project, go to Project Settings, and select Log Drains to check for configured drains.

  5. If retention is shorter than required and no Log Drain is set up, follow the implementation steps.

Implementation Steps

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Project Settings and select Log Drains.

  4. Add a log drain to your chosen destination (for example, Amazon S3 or Datadog) and enter its settings.

  5. Save and confirm that logs arrive at the destination.

  6. Alternatively, upgrade the plan to one with longer retention.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open Project Settings and select Log Drains.

  4. Remove the log drain that was added.

Reference