A replicated database architecture is described in which updates processed at a site must be saved to allow reconcilliation of newly arriving updates in a way that preserves mutual consistency. The storage space occupied by the saved updates increases indefinitely, and periodic discarding of old updates is needed to avoid running out of storage. A protocol is described which allows sites in the system to agree that updates older than a given timestamp are no longer needed and can be discarded. This protocol uses a "distributed snapshot" algorithm of Chandy and Lamport and represents a practical application of that algorithm. A protocol for permanent removal of sites is also described, which will allow the discarding of updates to continue when one or more sites crash and are expected not to recover.