I have a system where any events worthy of attention are displayed as notifications and highlighted in red on the main tool bar with a drop down menu.
I will pull the phrase "worthy of attention" out, for future reference.
Inevitably they never dismiss the notifications though which causes them to have hundreds.
Have you investigated why the users are not dismissing the notifications? I'd be concerned that it might be in part due to them not being invested in the notification system and not using it as intended to begin with.
If the notification system as designed isn't working for the user's task flows, a different notification scheme all together might be in order.
The problem is then obvious, new notifications are less likely to be seen.
This implies that new notifications are being added to the bottom of the list. Without knowing the implications of your notification system (e.g., is it "Bobby winked at you" or "Customer leaving unless you respond now" type notifications) it is difficult to comment on the merits of doing a oldest first vs. newest first list order.
If you are worried about users missing notifications a newest first does seem to be the first step. Undismissed notifications do not hide new notifications, but if older notifications are considered "more important" that skews the advantage.
I am considering
1) Notifications are automatically dismissed after a period (ie 2 days)
I'm pulling down that phrase from your first paragraph: "worthy of attention"
If a notification is truly worthy of the user's attention then how is it suitable to automatically dismiss that notification?
If a notification is a candidate for being automatically dismissed, then it means it can be missed. If your user "ignores the problem" (so to speak) it will eventually go away, so they don't need to look at them anyway. Such an action will only further divest your users in the notification system.
2) The user can mark a notification as not to be dismissed in which case it will stay
If your users are too uninvested in the system to click a "dismiss" button, it is highly unlikely they will ever click a "keep" button.
What do you think is the best solution?
It sounds like you are already following a very similar scheme to Google+'s notification system, the logic of dismissing them being discussed here Read & dismiss Google+ notifications. I am unsure if they follow a newest first or an oldest first order though (I don't have any notifications to verify on).
Focusing on newest first as part of the solution, take a look at Facebook's notification system:

This uses a newest first system. When I look at my notifications I may not care to dismiss them (due to laziness or perhaps future reference), but this does not effect my ability to see the latest alerts that have come in because they are added to the top.
The Facebook notification popup is provides the following:
Globe: Shows a badge when notifications have come in since the last time I opened the notification window (I didn't have any new notifications, so it isn't there). It doesn't show how many unread/undismissed notifications I have - just how many new since the last time I checked.
Blue Arrow: Everything can be marked as read, and I mess around with my notification settings easily.
Red Arrow: Shows unread notifications (blueish background) in the midst of read notifications (white background).
Greed Arrow: Controls to mark as read (circle) without visiting the post and to ignore future updates (x) are still available.
See All: Takes me to a history where I can see everything and review something I might be interested in.
Notice I have some "unread" notifications mixed in with all the others. Why are they unread? Perhaps I already read the post so I don't need to click on the notification. Perhaps I just don't care to. But it doesn't matter, because it will just fall off the bottom given time as newer notifications pop in.
I'm given the choice to handle the notification and I'm not punished for inaction.
What steps might you take for your notification system:
- Find out how your users are using the notification system and why they are not using it per expectations. If it does not meet their needs, a new system should be investigated.
- Consider a newest first ordering. They will not miss a new message. Have your badge indicate the number of new notifications since they last checked, not undismissed notifications.
- You can keep notifications until they are dismissed. If they are never dismissed, they just trickle down off the bottom.
- Depending on your system needs - color coding "read" vs. "unread" notifications might be useful.
- Consider a priority to keep more important notifications on top (if need be). Show all newest "critical" notifications first, all newest "warning" next, down to newest "just so you know" notifications.
- Provide quick links to mark everything a "read" or "dismiss all". Perhaps your users are not dismissing anything because they have to dismiss each one separately.
- Provide a sort function. Newest first? Older first? Unread or read first? Got you covered!