<a id="retain-audit-log-records"></a>

# Retain Audit Log Records on Confluent Cloud

Audit log records are retained for seven days on an independent Confluent Cloud
cluster. They cannot be modified, deleted, or produced directly to the
audit log topic. To retain records longer than seven days or modify
them for analytics, export or replicate the data to an external
Apache Kafka® cluster or other datastore.

<a id="use-connectors-to-export-audit-logs"></a>

## Export audit log records using a self-managed sink connector

You can export your Confluent Cloud audit log data from your audit log cluster’s topic
`confluent-audit-log-events` to an external target data store using a
[self-managed sink connector for Confluent Platform](https://docs.confluent.io/home/connect/self-managed/kafka_connectors.html).

#### IMPORTANT
Confluent Cloud audit logs cannot be consumed using Confluent Cloud fully managed sink connectors.

To use a self-managed sink connector to export audit log data, add
`consumer.override.bootstrap.servers` to the connector’s
`config.properties` file. This bootstraps the connector
to your target cluster. The Confluent Cloud audit log cluster is read-only, so
you must use the consumer override, or you receive a
`TopicAuthorizationException: Not authorized to access topics` error.

For an example that exports Confluent Cloud audit log data using the self-managed
[Splunk sink connector](https://docs.confluent.io/kafka-connectors/splunk-sink/current/overview.html),
see the Confluent blog
[How to Visualize Confluent Cloud Audit Log Data](https://www.confluent.io/blog/visualize-logs-for-simplified-security-in-confluent-cloud/).
The example displays the data for analysis in two dashboards: “Confluent Cloud Audit
Overview” and “Confluent Cloud Role Assignments”.

<a id="replicate-audit-logs"></a>

## Replicate audit log data into a managed Kafka cluster

Sync your audit logs to a managed Kafka cluster in Confluent Cloud using Cluster
Linking or Replicator to use fully managed tools, such as ksqlDB, Connect, and
Stream Governance, and manage security with role-based access control (RBAC) and API keys.

- For a step-by-step guide on using [Cluster Linking](../../multi-cloud/cluster-linking/index.md#cloud-cluster-linking)
  to sync your audit logs into Dedicated or Enterprise Confluent Cloud
  clusters, see
  [Use Cluster Linking to Manage Audit Logs](../../multi-cloud/cluster-linking/audit-logs.md#cloud-cluster-link-audit-logs).
- To sync your audit logs to Standard Kafka clusters in Confluent Cloud, you can
  use [Replicator](../../clusters/migrate-topics-on-cloud-clusters.md#replicator-deploy-modes-cloud).

## Related content

- [Best Practices for Audit Logs on Confluent Cloud](best-practices.md#best-practices-cloud-audit-logs)
- [Access and Consume Audit Logs on Confluent Cloud](configure.md#cloud-activate-audit-logs)
- [Audit Log Concepts on Confluent Cloud](cloud-audit-log-concepts.md#cloud-audit-logs)
