Event Log History

[tysonwenger]

Does anyone know the retention history for System Policy --> Event Log?       I was trying to look back for failed login attempts, but it appears to only go back a week or so.

Thanks,

-Tyson

[oharel]

Hi Tyson,

Maybe this will help: https://docs.servicenow.com/bundle/istanbul-servicenow-platform/page/administer/time/reference/secur...

harel

[nitin_kumar]

Hi Tyson,

Event Log table is part of the Table Rotation - ServiceNow Wiki that means any record whose 'sys_updated_on' is greater than a week will get deleted. Anyways you can change this by navigating to 'sysevent' record in   'System Definition > Table Rotation'.

Thanks,

Nitin.

Hit Like, Helpful or Correct based in the impact of the response

[nitin_kumar]

Hi Tyson,

If I have answered your question, please mark my response as correct so that others with the same question in the future can find it quickly and that it gets removed from the Unanswered list.

Thanks,

Nitin.

[tysonwenger]

Hi Nitin,

I was looking for that option but it doesn't appear on your post. I am logged in too, so I'm not sure how I can do that… See below for screenshot, I have no "Accept as answer" option anywhere.