How to reduce the logging for Agent Client Collector in the System LogSummaryIf you have thousands of Agent Client Collector installs, you are likely to have millions of log records added to the System Log [syslog] table. The problem with that is: Hard to debug anything. Can't see the wood for the trees.Table query performance is poor due to the huge number of records involved. Message 'contains' filters particularly a problem.Table footprint. Since 2023, database disk space is paid for. Source field values are: sn_agent - Agent Client Collector framework (ACC-F). Mainly Host data collection, and Policy related logging.sn_acc_visibility - Agent Client Collector for VisibilityMainly detailed logging of the processing of the discovery data and updates of the CMDB. Usually the biggest contributor.sn_acc_vis_content - Agent Client Collector for Visibility ContentAs above - please note, in February 2024 Agent Client Collector for Visibility was split into two plugins, one being Agent Client Collector for Visibility and the other being Agent Client Collector for Visibility Content. Depending on installed plugin versions, logging may mainly happen with this source field instead of sn_acc_visibilitysn_itmon - Agent Client Collector MonitoringData from Agents tend to go straight into the MetricBase or em_event tables, via special APIs, which is then processed by scheduled jobs belonging to the higher level apps, so you don't get much logging from this source.sn_accl - Agent Client Collector Log Analytics In general, you only need the minimum level of Error logging, and for the error level logs to truly mean an actual error that's breaking something is logged. Only when debugging would you want to temporarily raise the verbosity of the logging.Instructionssn_agent - Agent Client Collector framework (ACC-F) Here are the system properties to control the level of logging from ACC-F/-V The November 2023 release, ACC-F v3.3.1, added this instance system property as the first part of a logging improvement project: sn_agent.logging.verbosity https://<instance name>.service-now.com/sys_properties.do?sys_id=1c2ecc15435031108b19b1b58ab8f2f1 That has been added to the docs: https://docs.servicenow.com/bundle/vancouver-it-operations-management/page/product/agent-client-collector/reference/acc-framework-configuration-properties.html "The minimum level of messages that are logged for Agent Client Collector Framework. Messages with the indicated status and anything more severe are logged Options: error warn info debug Default: warn" This change also decreased the data collection logging a lot, by defaulting to Warning (and Errors) only. Info messages will no longer be written to syslog by default. You can change it to error to not even get the warnings. Unless you are actively debugging ACC issues, you can leave this at the minimum 'error' level, and temporarily increase the log level when actually debugging. FYI: The second half of this project is to add a feature to allow turning on the debug for an Agent install, from the instance, instead of having to manually edit the acc.yml file. Keep an eye on the ACC-F release notes in early 2024 to see when that appears. sn_acc_visibility - Agent Client Collector for Visibility ACC-V is planning to do something similar to ACC-F, around mid-2024. Until then, this workaround can be used, which is based on this KB article:KB0714743 - Application Logging and the logging.destination and logging.verbosity System Properties Create these System Properties in the sys_properties table: sn_acc_visibility.logging.destination = db Specifying db in the Value field for this property indicates that the log messages for the scoped application should be written to both the localhost logs and the syslog table.sn_acc_visibility.logging.verbosity = error to only log errors, not info and warning, so a a lot less syslog records as a result. sn_acc_vis_content - Agent Client Collector for Visibility Content Following the split into two applications, the same properties must be set for sn_acc_vis_content as for sn_acc_visibility Create these System Properties in the sys_properties table: sn_acc_vis_content.logging.destination = dbsn_acc_vis_content.logging.verbosity = error Other ACC app scopes The same idea as KB0714743 can be used for other scopes too. Any scripts running in the scope, and using gs.debug(), gs.info(), gs.warn() or gs.error() will get filtered using the scope specific property, at a lower platform level. <scope name>.logging.destination=db<scope name>.logging.verbosity=error There may also be app-specific properties that can be set, so please check the properties documentation for the app first.