Articles, Blogs, Videos, Podcasts, Share projects - Experiences from the field
Hi there,
Every ServiceNow release has some hidden gems, and the Zurich (Early Availability) release is no other. During (Unofficial) Live Coding Happy Hour, Rafael Cordoso and I quickly ran into some of the undocumented features. One thing I noticed, though 1-hour livestreaming is a bit too short, something with "Sys Audit Retention".
A few days later and playing around on my Personal Developer Instance, discovering, and wow… Let's have a closer look!
Hunting the undocumented
When a new ServiceNow release becomes available, I usually go through some known tables and search for newly created records. For example System Properties, Tables, Dictionary entries, Flows, Flow Actions, Business Rules, etcetera. This way you can quickly spot new features on the ServiceNow platform, often recognizing what you've read in release notes, though also where you'd instantly think what might this be?
During my search amongst others I spotted these Tables and Schedule.
Usually I'll then also search for this on de ServiceNow Docs, it might still be documented though just not mentioned in the release notes. In this case: no match. Then only one thing to do… just open it, play guess, play around 😀.
Sys Audit Relation
Viewing the Sys Audit Cleaner Job Progress table [sys_audit_cleaner_job_progress] initially, I didn't have a clue yet. So on to the Sys Audit Retention table [sys_audit_retention]. Opening this table, you might think you don't have any write access. No worries, you are an admin, just view the Access Controls, it's a Personal Developer Instance so if needed just grant yourself the access!
In this case, just a matter of elevating to Security Admin.
The form, the two fields, in my opinion pretty self-explanatory. Select a table, select a retention period.
If the name of the table is as self-explanatory as it looks like, then somehow these records should be used to perform a cleanup matching what you clicked together. Often such would be visible in the Schedule table [sys_trigger]. Though wait, didn't we see a new Schedule, AuditCleanerScheduleJob?
AuditCleanerScheduleJob
Viewing the AuditCleanerScheduleJob Schedule, it appears to be daily scheduled. What it exactly does we can't see from the record, though it's a Personal Developer Instance… so let's just trigger the Schedule ourselves 😀.
After the job finished, I automatically jumped to the Sys Audit table [sys_audit] and saw the result! Though switch back a moment, back to that other table: Sys Audit Job Progress. When you have Sys Audit Retention records in place and the AuditCleanerScheduleJob is triggered (and has work to do), then there will be records created in the Sys Audit Job Progress table that looks like some metadata about the cleanup.
How the AuditCleanerScheduleJob exactly works is a mystery. Looking at the related Job ID, it doesn't share any of its secrets.
Sys Audit
I did spoil it already a bit, the Sys Audit and… it is being cleaned up by the configured Sys Audit Retention. How cool is this!
Maintaining Sys Audit is often one of the harder parts in a ServiceNow instance. A table that is generally in the top 5 of the largest tables in any given instance. For larger customers having billions of records and eating up Terabytes of your Database Footprint (and possibly resulting in over-licensing).
I did publish multiple articles on maintaining amongst others the Sys Audit and most still needs to be done, ideally during implementations. Though having this no-code Sys Audit Retention available… wow! A new feature which should be added to everyone's checklist for accepting new processes or custom apps: Define what to Audit (what you hopefully already do) and the Audit Retention period!
Note: What the performance of Sys Audit Retention I can't tell yet since the data on a Personal Developer Instance is very limited.
---
And that's it! Hunting down Zurich's undocumented.
Hope you like it. If any questions or remarks, let me know!
| C |
If this content helped you, I would appreciate it if you hit bookmark or mark it as helpful.
Interested in more Articles, Blogs, Videos, Podcasts, Share projects I shared/participated in? |
Kind regards,
Mark Roethof
Independent ServiceNow Consultant
10x ServiceNow MVP
---
