Event Table Rotation
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎08-15-2024 10:54 PM
I checked the records for the event table [em_event] and found that there are only records up to 5 days ago.
I understand that the event table rotation is 1 day x 7 times by default,
Does this not mean that the past 7 days are retained?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎08-15-2024 11:48 PM - edited ‎08-15-2024 11:53 PM
Hi @shiki ,
Yes it should retain records from the past 7 days.
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0953365
For more info:
1. Table Rotation
As the name implies, Table Rotation just implements a way of storing a limited amount of data on a table based on several parameters.
This means oldest data in the table will be deleted at a certain point in time.
How is this really done?
If we take the example of syslog table (System Definition -> Table Rotations -> syslog), you will see the following:
- Duration: 7
- Type: Rotation
- Rotations: 8
- Table Rotations Schedule: shows syslog along with other 8 tables starting with syslog0000 to syslog0007
First each of these tables under the form syslog0000 are called shards (or subtables if you want).
Each of these shards will store 7 days of data and with 8 in total we will have roughly around 56 days of data in total in syslog (the base shard syslog is cleaned automatically on first rotation which means over time it has no data).
The Table Rotations Schedule will show what is the exact start (Valid from) and end (Valid to) of storing period for each shard.
Now, what are some of the advantages of this model:
- older data can be removed without impacting existing data being inserted/queried
- the whole table will grow only to a reasonable size
- when querying based on creation date, we might only look in one shard alone
What are some of the disadvantages of this model:
- queries that don't use a creation date (sys_create_on) will force an expensive UNION ALL query that can be very slow
Mark it as helpful and solution proposed if it serves your purpose.
Thanks,
Anand
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎08-16-2024 12:09 AM
@Anand Kumar P
Thank you.
If you can keep records for the past 7 days, then you should have records through 8/10.
I see from the rotation schedule that it is for 7 days from 8/12 to 8/18,
Does this mean that it will keep records for the 7 days according to the schedule, rather than the past 7 days?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎08-16-2024 04:19 AM
Hi @shiki ,
The system will retain events from past 7 days to current date. If today is 8/18 the system should retain events from 8/11 through 8/17.
Mark it as helpful and solution proposed if it serves your purpose.
Thanks,
Anand
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎08-18-2024 05:34 PM
Thanks @Anand Kumar P
Today is 8/19, but only records from 8/15 exist.
I haven't changed the table rotation settings from the default, but can't we keep records from 7 days with the default?