A machine learning model repeatedly scans data exhaust for workstations (for which there are retention requirements regarding data exhaust) over a period of time. The machine learning model analyzes the respective data exhaust and the retention requirements to determine respective data exhaust logging parameters for each workstation. The machine learning model monitors respective data exhaust activity for each workstation over a subsequent period of time. An instance is identified in which logging activity of data exhaust for an identified workstation fails the retention requirements. An ameliorative action designed to satisfy the respective retention requirements for the identified workstation is executed.