<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Log Retention Management — API Reference

## AWS S3 Lifecycle Configuration

```python
import boto3

s3 = boto3.client("s3")

# Set lifecycle policy for tiered retention
s3.put_bucket_lifecycle_configuration(
    Bucket="security-logs",
    LifecycleConfiguration={
        "Rules": [
            {
                "ID": "hot-to-warm",
                "Status": "Enabled",
                "Transitions": [
                    {"Days": 30, "StorageClass": "STANDARD_IA"},
                    {"Days": 90, "StorageClass": "GLACIER"},
                ],
                "Expiration": {"Days": 365},
                "Filter": {"Prefix": "firewall/"},
            },
        ]
    },
)
```

## Elasticsearch ILM

```python
import requests

ES_URL = "http://elasticsearch:9200"

# Create ILM policy
requests.put(f"{ES_URL}/_ilm/policy/security-logs", json={
    "policy": {
        "phases": {
            "hot": {"min_age": "0ms", "actions": {"rollover": {"max_size": "50gb"}}},
            "warm": {"min_age": "30d", "actions": {"shrink": {"number_of_shards": 1}}},
            "cold": {"min_age": "90d", "actions": {"freeze": {}}},
            "delete": {"min_age": "365d", "actions": {"delete": {}}},
        }
    }
})
```

## Integrity Verification

```python
import hashlib

def hash_file(path: str) -> str:
    h = hashlib.sha256()
    with open(path, "rb") as f:
        for chunk in iter(lambda: f.read(8192), b""):
            h.update(chunk)
    return h.hexdigest()
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Retention policies enforced — no action needed |
| 1 | Logs eligible for migration or purge |
| 2 | Integrity verification failure |
