How long does a closed alert exist in the em_alert table?

[erlfos]

I would like to know how long a closed alert exists in the em_alert table before it is removed (I think 12 months, but I am not sure), how it is removed (business rule, scheduled job?) and if it is possible to change the time it takes before an alert is removed from the em_alert table. Any help appreciated.

[Henrik Jutterst · Accepted solution]

Hi there!

Out of box is like this:

• em_event = 5 days
• em_alert = 90 days

Link: https://docs.servicenow.com/bundle/quebec-it-operations-management/page/product/event-management/tas...

"If records are older than 90 days, by default they are purged. If records are retained for a longer period, larger volumes of data are stored, and performance may be impacted."

[Siva teki]

Hi @Henrik Jutterst ,

As you mentioned, the retention period for the em_event table is 5 days. Is there any property that controls this configuration? For alerts, I see that the cleanup is handled via the sys_auto_flush table. Could you please let me know where we can manage the retention for the em_event table?

[erlfos]

Hi Henrik

Thank you for your reply. I think you are correct. It looks like it is 90 days after the last update time when the alert is in closed state.