About the Basic Log Tables That Should Be Maintained

[kuworkuwa]

We are currently operating a ServiceNow instance and are trying to select the logs that should be retained for long-term storage. We plan to transfer the logs to an external server according to the customer's requirements, ranging from several months to about a year. Could you please advise which log tables should be included in this transfer? We intend to use these logs for personal analysis if there are any issues with ServiceNow, and also to provide them when making inquiries to NowSupport. For example, we are considering the following logs as the target, but please let us know if there are any others we should include.

・Event[ecc_event]
・Queue[ecc_queue]
・Event[sysevent]
・System Log[syslog]
・Transaction[syslog_transaction]
・Mail[sys_email]
・Sys Audit[sys_audit]
・Import Log[import_log]
・Security audit[sys_security_audit]
・History [sys_history_line]
・Outbound HTTP Logs[sys_outbound_http_log]
・Data Source[sys_data_source]

[Kieran Anson]

Retaining logs for the sake of retaining logs is a tad pointless. Yes, external storage is cheap, but most of the tables you've listed aren't intended for regular export unless you plan to use 'Log Export Service'. However LES can only do a subset of tables found here.

"according to the customer's requirements" - Have they provided justification for each one of those tables?

[kuworkuwa]

As a supplementary note, we are planning to transfer the logs, i.e., the records, to an external location using Scheduled Data Export, Export Definition, and Export Target. Therefore, we understand that the source tables for the logs are not restricted. In a situation like this, if there are any recommendations on which table records we should output, we would appreciate your advice.