Event Table Rotation

shiki
Tera Contributor

I checked the records for the event table [em_event] and found that there are only records up to 5 days ago.
I understand that the event table rotation is 1 day x 7 times by default,
Does this not mean that the past 7 days are retained?

6 REPLIES 6

Anand Kumar P
Giga Patron
Giga Patron

Hi @shiki ,

Yes it should retain records from the past 7 days.
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0953365 

For more info:

1. Table Rotation

As the name implies, Table Rotation just implements a way of storing a limited amount of data on a table based on several parameters.
This means oldest data in the table will be deleted at a certain point in time.

How is this really done?

If we take the example of syslog table (System Definition -> Table Rotations -> syslog), you will see the following:

- Duration: 7
- Type: Rotation
- Rotations: 8
- Table Rotations Schedule: shows syslog along with other 8 tables starting with syslog0000 to syslog0007

First each of these tables under the form syslog0000 are called shards (or subtables if you want).
Each of these shards will store 7 days of data and with 8 in total we will have roughly around 56 days of data in total in syslog (the base shard syslog is cleaned automatically on first rotation which means over time it has no data).

The Table Rotations Schedule will show what is the exact start (Valid from) and end (Valid to) of storing period for each shard.

Now, what are some of the advantages of this model:

- older data can be removed without impacting existing data being inserted/queried
- the whole table will grow only to a reasonable size
- when querying based on creation date, we might only look in one shard alone

What are some of the disadvantages of this model:

- queries that don't use a creation date (sys_create_on) will force an expensive UNION ALL query that can be very slow

Mark it as helpful and solution proposed if it serves your purpose.
Thanks,
Anand

@Anand Kumar P 
Thank you.
If you can keep records for the past 7 days, then you should have records through 8/10.
I see from the rotation schedule that it is for 7 days from 8/12 to 8/18,
Does this mean that it will keep records for the 7 days according to the schedule, rather than the past 7 days?

shiki_0-1723792134048.png

 

Hi @shiki ,

The system will retain events from past 7 days to current date. If today is 8/18 the system should retain events from 8/11 through 8/17.

 

Mark it as helpful and solution proposed if it serves your purpose.
Thanks,
Anand

Thanks @Anand Kumar P 
Today is 8/19, but only records from 8/15 exist.
I haven't changed the table rotation settings from the default, but can't we keep records from 7 days with the default?