Applications Systems
SAM Windows Events older than 1 month are missing in SolarWinds Platform
More than 1 month old Windows events are not showing in the database or web console, even if the highest retention period is configured.
First published date
Last published date
Overview
In SAM Database Settings, the default "Event log message retention" is 30. If you increase this value, it will be ignored and will not reflect in the Web Console or Database.
The data is stored in The APM_WindowsEvent_* tables, however, you can see only the last 30 days..
Product section
Cause
When configuring the retention period for APM Windows Events, the system deletes events based on the "Detail statistics retention" setting rather than the expected "DataRetentionEventLog" configuration value.
As a result, increasing or decreasing the Detail retention directly affects the Windows Events retention, and the configured DataRetentionEventLog value is ignored.
The Windows Events retention should be governed by the DataRetentionEventLog configuration value. Changing "Detail statistics retention" should not affect Windows Events retention.
Windows Events retention period matches the "Detail statistics retention" value, ignoring the DataRetentionEventLog setting.
Resolution
This issue is addressed in SAM 2026.1. Consider upgrading your environment. If you cannot upgrade, as a temporary workaround, you can set the SAM "Detail statistics retention" to your desired Windows Events retention period.
Please note this can impact all components (not only Windows Events), which can increase the DB size.