[adambatkin]

And if it is May 29 and you notice an attacker has been lurking in your network for at least 2 weeks (but you don't yet know exactly when it started or how they got in) you will be very happy that you have netflow and access logs going back 30 or 60 days or a year. And that's considered an operational requirement for anyone who cares about the safety and security of their systems and networks.

[hodgesrm]

We store certain audit logs forever--or close to it--for exactly this reason. You don't know when you'll need the data to assess possible breaches and report back to users. (Which not coincidentally is a requirement of GDPR.)

Edit: clarified "forever"