The System Logs module provides a variety of logs that you can use to troubleshoot and debug transactions and events that take place within the instance. 


Please find the information related to servicenow logs.
Below are the various tables that stores logs, the system uses table rotation and table extension to archive the logs, and by default, the system uses a schedule depend on the table:

  • For Event [ecc_event] Queue [ecc_queue] and Event [sysevent] the archive schedule is every day and rotation is 7.
  • For Log [syslog] and Transaction Log [syslog_transaction] the archive schedule is every week and rotation is 8.
  • For Email [sys_email] the archive schedule is every 30 days and rotation is 8. 
By default, ServiceNow has taken into consideration many factors and have come up with a standard configuration which is what is seen deployed on a ServiceNow instance.

Please review the following documentation for self reference:

  • System Logs (syslog) table is used to keep application logging.
  • Out Of The Box, we have table rotation enabled for this table. As this is a transient data for troubleshooting issue. The default rotation is set to 7 days x 8 rotations.Which is around 56 days before it get recycled.That satisfied the need for most of our customers.
  • It is not recommend to retain logging for too long as it can grow big quickly. When it is too big, it becomes difficult for analyzing and slow for searching.

The system uses table rotation and table extension to archive older logs.
By default, the system uses the following schedule to archive common logs: 

Common log archive schedule:
Table                                |Archive schedule |Rotations |Type
Event           [ecc_event]          |Every day        | 7        |Rotation
Queue           [ecc_queue]          |Every day        | 7        |Rotation
Event           [sysevent]           |Every day        | 7        |Rotation
Log             [syslog]             |Every week       | 8        |Rotation
Transaction Log [syslog_transaction] |Every week       | 8        |Rotation
Email           [sys_email]          |Every 30 days    | 8        |Extension
  • Logs are stored internally in the data center of an instance.
  • Based on the type of log, relevant information is retrieved.
  • Please note that there are performance implications when you modify data retention period. You will therefore need to carry out thorough tests on your sub prod systems.

You can navigate to system logs module in your instance which shows all the logs types and when you open each link, it will navigate to the corresponding page and you can find the table name in the url.

Additional Information

Localhost logs and wrapper logs can be found under "node log file" module for each node the user is connected. 
The instance creates compressed archives of system logs every two days and purges log archives after 21 days.

Article Information

Last Updated:2020-10-23 10:24:36