20 million audit logs can't be wrong, can they?

[jMarshal]

I just finished my Xanadu delta (relevant, but I won't say why - ikyky), and I am now looking at sys_audit.list on my instance and see that I've got over 20 million records there -- 7 year's worth of data, as we've been customers since 2017.

This can't be sustainable and I can only imagine that this is contributing to instance performance (we don't have any noticeable degradation, yet...but I want to keep it that way, too).

What are some best practices around data retention related to these audit logs, specifically?

Our Records Management department has retention policies which max out at 7 years, so I could just start deleting stuff as it falls off at 7 years and this table will only ever be in the 20-30M range...but that also seems quite large.

I don't have much experience with table rotation yet, but I have read about it and perhaps that can help here.

Again, just fishing for basic/general info, at this point (the good kind, not the "ph" kind 😜 ) -- not looking for a "solution" to any problems. TIA! 😁

[Bert_c1]

Servicenow is well aware of the impact of the sys_audit table size. they will assist with any performance problems should they occur. Create a Support Case for your concerns and get their opinion.

[Mark Roethof]

Hi there,

20 million records in 7 years, that's a pretty low number 🙂 One of my current customers, had about 8 years of data and 2,5 billion sys_audit records.

Some customers have sys_audit on table extension, out-of-the-box its not. That could help.

Biggest help: cleaning up your sys_audit regularly, after patches/hotfixes/upgrades checking the sys_audit on newly useless audit added by ServiceNow, when implementing or implementing a new plugin or custom app critically looking at the sys_audit and configuring it purposely.

In case you are going to cleanup millions of records of sys_audit, be aware that this won't immediately speed up anything. You need have the table rebuild/optimized! See the several blogs I wrote on this subject.