How to view access (login failed) and how to define retention of this data in Servicenow - Support and Troubleshooting

How to view access (login failed) and how to define retention of this data in Servicenow Issue  A significant number of Servienow administrators are unsure how login data is managed in Servicenow.

They also want to know more about security options for auditing and how long this data is kept in Servicenow instances ?

Release All

Cause This query related to the access and usage logs retention arises because of company security requirements in a number of companies due to current legal framework

Resolution  1 - Out of the box login events

There are login events out of the box, those login events are stored in the events table, see screen prints for an example.

The event table has a rotation of 7 days, this means that the longest those events are kept will be 7 days our of the box

Rotation of log tables (Madrid) https://docs.servicenow.com/csh?topicname=security-log-history.html&version=latest

2 - Optional Event Management plugin

You can change the out of the box functionality or complement it by archiving some events

You need to optionally enable the Event Management plugin

Event Management configuration preferences https://docs.servicenow.com/csh?topicname=r_EMBestPractice.html&version=latest

Archive events Avoid changing the default retention time for events. To log events for a longer time, create an archive table and a job that copies new events to it. Do this by scheduling a job to regularly back up events [em_event] to a custom table. Do not extend table rotation by adding more days.