In a managed client the time period to retain the AV/AS logs is controlled by the SEPM. However on the client side the client can change the time period to retain the AV/AS logs. This time frame setting as amended from the client side remains in effect till the SMC service is stopped and started. Once the SMC service is stopped and started the client will revert to the time frame set by the SEPM for retaining the logs.