Are you certain these are log entries that have been created by your teams, and not the result of applications / processes running in PROD? Some applications, like Discovery, can be extremely verbose and processes like SSO can also generate a ton of logs in a busy instance.
That being said, I'd say it's not unusual to see 1 - 2 million record days in a well utilized instance however that you are reporting (more than a million in an hour) would be excessive and would indicate a potential issue.
The best practice is always to minimize system logging in scripts where possible. If you can be certain that one or more of your own processes is generating excessive traffic, it's worth reviewing that process and eliminating gs.log / gs.info unless they serve a definable, measurable purpose. A lot of times logging is just left in place after development without consideration for the impact that it can have (a few test transactions vs. thousands)
If you do need to put deep level logging in place to support troubleshooting, there are a couple of tips that can help minimize log churn.
First, use gs.debug() where you can. That doesn't write to the log table but can be viewed by enabling session debugging - it is a little harder to find what you are looking for, but the trade-off is typically worth it. You're able to leave verbose logging in place (instead of having to add logging when you find an issue) but you won't have any historical records - you can only troubleshoot in your current session.
Second, in long scripts or processes, I often create an object or an array and push log statements to that, and only at the end of the process do I write that array or object (stringified) to the logs. That way you don't have 100 tiny logs, but rather one log per "run" that you can review.
Last, as mentioned, you can mitigate the issue somewhat with a filter that reduces the time-frame for which logs are displayed, if you have a good idea of the time frame. I usually look at the last 5 minutes in a busy instance, personally:
https://<your_instance_name>.service-now.com/syslog_list.do?sysparm_query=sys_created_onRELATIVEGT%40minute%40ago%405&sysparm_view=
You can also load the list with no records and just the filter, so that you can narrow it down even further before you query if you'd like:
https://d<your_instance_name>.service-now.com/syslog_list.do?sysparm_filter_only=true
I hope this helps!
If this was helpful, or correct, please be kind and mark the answer appropriately.
Michael Jones - Proud member of the GlideFast Consulting Team!
I hope this helps!
Michael D. Jones
Proud member of the GlideFast Consulting Team!
