Storage space for log retention in Health Log Analytics
The Health Log Analytics base system typically provides 1,000 GB storage space for log source retention, although the storage capacity may vary depending on your license. The default retention time for logs is three days, but you can modify that period.
This feature is supported in the Health Log Analytics application, Version 22.0.12 - December 2021 and later, available from the ServiceNow Store. To activate it, contact your ServiceNow account manager or ServiceNow Support.
When the storage space used by all log sources exceeds 80 percent of the total, you receive an email notification. You can change the default threshold percentage by modifying the sn_occ.elastic_storage.utilization_limit.percent system property in the System Properties table.
Automatic reduction of log retention days
By default, logs are retained for three days. You can adjust this period to 3, 7, 14, or 30 days. For more information, see Modify the log source retention period in Health Log Analytics.
If the storage space used by all log sources reaches 100 percent, the number of retention days allocated per source is automatically lowered by one level and you receive an email notification with the specifics. The automatic reduction process starts with the sources that were allocated the highest number of retention days. For example, for a source with 30 retention days, the number is reduced to 14. If the source has 14 retention days, the number is reduced to 7, and so on.
You can change the threshold percentage for the automatic reduction of log retention days by modifying the sn_occ.log_retention.automatic_reduction_utilization_percent system property in the System Properties table.