--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Configuration preferences # Health Log Analytics configuration preferences {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Health Log Analytics configuration preferences This document outlines the essential configuration preferences and requirements for Health Log Analytics in ServiceNow, focusing on MID Server settings, log ingestion capacity, and log retention policies. These settings are critical for optimizing log streaming performance and managing data retention effectively. Show full answer Show less ## Key Features * **MID Server Settings:** * Enable log ingestion capability on the MID Server; enabling all capabilities also activates log ingestion. * Use dedicated MID Servers for log ingestion when possible for performance optimization. * Minimum hardware requirements: 4 CPUs, 16 GB RAM, and 8 GB Java heap size. * Preferred hardware specifications for optimal throughput: 8 CPUs, 32 GB RAM, up to 10 Gbps network bandwidth, and 8,192 MB Java heap size. * Multiple product support on the same MID Server requires sufficient JVM memory per thread. * Java Runtime Environment (JRE) 11 or higher is mandatory for MID Servers with Health Log Analytics capability, supporting both FIPS and non-FIPS modes. * Limitation of 10 data inputs per MID Server by default, configurable per server or globally. * Increased throughput options include raising the ulimit for open files, increasing network bandwidth, or reducing log size. * Starting August 2024, the Lightning gRPC client can be manually enabled to improve log streaming speeds up to six times. * **Log Ingestion Throughput:** * Throughput varies by log message size, e.g., 20,000 messages per second for 300-byte logs on preferred hardware. * Ulimit settings impact throughput, with higher rates for in-memory queues versus disk-based queues. * **Log Source Retention Settings:** * Default log retention per source is fixed at three days and is not modifiable by default. * Using Health Log Analytics Version 22.0.12 (December 2021) or later from the ServiceNow Store allows modification of log retention policies per source or in bulk. * **Version Requirements:** * Health Log Analytics requires upgrade to version 34.0.37 (December 2024) to support BC-FIPS version 2.0. ## Key Outcomes * By adhering to these configuration preferences, ServiceNow customers can optimize log ingestion throughput and efficiency in Health Log Analytics. * Proper MID Server sizing and configuration ensure stable and high-performance log streaming. * The ability to modify log retention policies starting with certain versions provides greater control over log data lifecycle management. * Enabling the Lightning gRPC client offers significant performance improvements for log streaming when manually configured. Commonly used settings for Health Log Analytics properties and general configuration. ## MID Server settings {#hla-configuration-preferences__section_ysb_5rw_nnb} * The MID Server log ingestion capability must be enabled. Note: Enabling All capabilities on the MID Server includes enabling the log ingestion capability. * Use dedicated MID Servers for log ingestion whenever possible. * To enable MID Servers to run multiple products, Health Log Analytics must have at least the Java Virtual Machine (JVM) memory setting for the standard product for each MID Server thread configuration. {#hla-configuration-preferences__ul_bjh_b13_y1c} The preferred MID Server settings for Health Log Analytics are: * * CPUs: 8 * RAM: 32 GB * Network Bandwidth: Up to 10 Gbps * EBS Bandwidth: Up to 4,750 Mbps * Maximum Java heap size for MID Server: 8,192 MB {#hla-configuration-preferences__ul_ilr_vg5_s1c} With the above specifications, the expected log ingestion throughput on a Washington DC instance is as follows: * For a log message of 300 bytes: 20,000 * For a log message of 1.1 KB: 12,300 * For a log message of 2 KB: 7,970 {#hla-configuration-preferences__ul_ewh_1f5_s1c} The minimum requirements for streaming logs to Health Log Analytics are: * CPUs: 4 * RAM: 16 GB * Java heap size for MID Server: 8 GB {#hla-configuration-preferences__ul_dk5_1ln_cbc} For general information, see: [MID Server system requirements](https://www.servicenow.com/docs/access?context=r_MIDServerSystemRequirements&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US). * To increase log ingestion throughput, you can either increase the ulimit or the network bandwidth, or decrease the size of the logs being streamed. The ulimit setting can be configured on an individual MID Server. However, the correlation between the ulimit and the throughput can't be modified. The following table lists the ulimit settings for open files relating to network throughput on the MID Server. It shows the size of the logs being streamed from the MID Server to the agent, and the gRPC streaming rate equivalent to the throughput. {#hla-configuration-preferences__table_jp2_2sw_nnb__entry__3} | Queue Type | Log line size | gRPC rate | |-|-|-| | In Memory Queue | 300 bytes | 18,000 | | In Memory Queue | 1.1 KB | 13,000 | | In Memory Queue | 2 KB | 10,000 | | Disk-based Queue | 300 bytes | 11,000 | | Disk-based Queue | 1.1 KB | 5,000 | | Disk-based Queue | 2 KB | 3,000 | [Table 1. Ulimit settings in relation to throughput] {#hla-configuration-preferences__table_jp2_2sw_nnb} Starting from the August 2024 release, you can enhance MID Server communication with the ServiceNow instance by using the Lightning gRPC client. This can increase log streaming speeds to Health Log Analytics by up to six times. The Lightning gRPC client requires manual configuration to activate. For more information, see the [Lightning gRPC client - Enabling the new MID gRPC streaming architecture \[KB1648419\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648419) article in the Now Support Knowledge Base. * By default, the number of data inputs per MID Server is limited to 10. You can configure this limitation for an individual MID Server or for all MID Servers. * Both in FIPS and non-FIPS mode, MID Servers with Health Log Analytics capability must run on the Java Runtime Environment (JRE) 11 or above. Note: To support BC-FIPS version 2.0, Health Log Analytics requires an upgrade to version 34.0.37, December 2024. {#hla-configuration-preferences__ul_h1f_wrw_nnb} ## Log source retention settings {#hla-configuration-preferences__section_bsd_t1w_wrb} By default, log retention per source is set to three days. This setting can't be modified. When using Health Log Analytics application, Version 22.0.12 - December 2021 and later, available from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) , you can modify the log retention policy per source or for multiple sources together. For more information, see [Modify the log source retention period in Health Log Analytics](https://www.servicenow.com/docs/k31bvtuMYxNNxDoEjKo8lg "Modify the period that Health Log Analytics retains logs from a specific source. You can calculate the impact of your intended change on storage to help you make an informed decision.").