# How do we preserve logs before they are overwritten?

Export them as soon as an incident is suspected, before you change anything else. Many devices keep logs only for days or until a size limit: firewalls, VPN gateways, switches and some cloud services overwrite the oldest entries first, and an active attacker may try to delete them. Make a list in advance of the logs that matter, typically firewall, VPN, directory and authentication, e-mail, endpoint console and DNS, and how to export each one. During the incident, copy them to storage outside the affected systems, record the time and a hash of each file, and raise retention on the devices if you can. Ask your cloud providers how far back their audit logs go. NetSenX stores its alerts in its own service for the alert history your plan includes, 30 days on Free and longer on paid plans, whatever happens to your devices.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/how-to-preserve-logs-before-they-are-overwritten

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What does eradication mean in incident response?](https://netsenx.com/en/faq/what-does-eradication-mean-in-incident-response)
- [How do we reset passwords safely after a breach?](https://netsenx.com/en/faq/how-to-reset-passwords-safely-after-a-breach)
- [How do we know the attacker is really gone?](https://netsenx.com/en/faq/how-do-we-know-the-attacker-is-really-gone)
- [Can we keep using our computers after a ransomware attack?](https://netsenx.com/en/faq/can-we-keep-using-computers-after-ransomware)
- [How do we recover safely after a cyber incident?](https://netsenx.com/en/faq/how-to-recover-safely-after-a-cyber-incident)