Skip to page contentSkip to chat
ServiceNow support
    • Community
      Ask questions, give advice, and connect with fellow ServiceNow professionals.
      Developer
      Build, test, and deploy applications
      Documentation
      Find detailed information about ServiceNow products, apps, features, and releases.
      Impact
      Accelerate ROI and amplify your expertise.
      Learning
      Build skills with instructor-led and online training.
      Partner
      Grow your business with promotions, news, and marketing tools
      ServiceNow
      Learn about ServiceNow products & solutions.
      Store
      Download certified apps and integrations that complement ServiceNow.
      Support
      Manage your instances, access self-help, and get technical support.
How to Investigate User Account Activity - Known Error
  • >
  • Knowledge Base
  • >
  • Support and Troubleshooting (Knowledge Base)
  • >
  • How to Investigate User Account Activity
KB0564981

How to Investigate User Account Activity


39143 Views Last updated : Jul 1, 2025 public Copy Permalink English (Original)
  • English (Original)
  • Japanese
KB Summary by Now Assist

Issue

For the latest information about Monitoring user activity, see Monitoring user activity.

At any time there is a need to review specific user behavior, below are the recommended steps on how to review the transaction logs and event logs:

  • Locate the IP address of successful/failed login for a particular ServiceNow user for their instance
  • Modify the time frame of the search
  • Limiting the scope of the search by user name
  • Successful/Failed login attempts

Procedure

Locate User Activity Process Steps

  1. Log in to the instance as an admin
  2. Identify Transaction Logs
    • Transaction logs by default are kept for over 49 days unless the instance admin has adjusted the table rotations for [syslog_transaction] table.
  3. Navigate to System Logs > Transactions https://<instance_name>.service-now.com/syslog_transaction_list.do
  4. Adjust filter to narrow down logs for investigative purposes
    • Required timeframe: The filter is "Created"
    • Username: The filter set as "Created by" with the option of "starts with" either/or "contains"



  5. Narrow the log date range

            From this list view we can then adjust the filter as below:
    • Created on – Adjust do any date or timeframe the customer needs
    • Created by – Adjust to the affected username

  6. Identify the IP address of the user login:
    1. Click on the cogwheel in the upper left corner of the table to open the Personalized list column. 



    2. To view the IP address of the logged-in user you can add the IP address column to the list view via the Personalize List columns module. 


Identify Successful/Failed Login Attempts

Note that this is only for local accounts.

  1. Log in to the instance as an admin
  2. Navigate to System Logs > Events

    https://<instance_name>.service-now.com/sysevent_list.do?sysparm_query=sys_created_onONToday%40javascript:gs.daysAgoStart(0)%40javascript:gs.daysAgoEnd(0)%5EGOTOnameSTARTSWITHSNC.Auth.DB

  3. Adjust filter as follows:



  4. From this list view we can then adjust the filter as below:
    • Created on – Adjust do any date or timeframe the customer needs
    • Created by – Adjust to the affected username

 

Additional Recommended Actions for Evaluating Activity of Concern 

Once the above steps have been completed, it is recommended that the customer also performs the following actions to determine if any suspicious activity has taken place that either was not captured in the logs identified or occurred outside of the current log retention period set:

  1. Determine the roles assigned to the target user by reviewing the sys_user_has_role table and filtering to entries for the user in question.
  2. Review the sys_audit table for any unexpected changes made within their instance – please see this docs page for more details: https://www.servicenow.com/docs/csh?topicname=c_UnderstandingTheSysAuditTable.html&version=latest 
  3. Review their sys_user table for any newly created users that are not recognized, especially those with privileged roles.
  4. Review Service Accounts and ensure they are configured according to best practices linked at this KB: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1933421 
  5. Review if there are any newly scheduled jobs that are not recognized by the platform owner team. Please see this docs page for details on how to review Scheduled Jobs: https://www.servicenow.com/docs/csh?topicname=view-scheduled-jobs.html&version=latest 
  6. Review the Customer Updates table for any unexpected activity. Details on how to navigate this table can be found in the linked documentation: https://www.servicenow.com/docs/csh?topicname=r_CustomerUpdatesTable.html&version=latest 
  7. Review the Security Center Metrics dashboard (/now/security-center/my_security_metrics), especially the below metrics:
    1. Privileged Users: Local logins of privileged users not protected by MFA in Security Center
    2. Privileged Users: New users
    3. Privileged Users: Successful logins
    4. Users: Successful logins
    5. Users: Inactive users who are not locked out
    6. Users: New users
    7. Privileged Identities: Admin users added  
    8. Privileged Identities: Admin logins  
    9. Authentication: Users using MFA Bypass
    10. Authentication High privileged non-MFA users
    11. Export: Total Exports 

The world works with ServiceNow.

Sign in for more! There's more content available only to authenticated users Sign in for more!
Did this KB article help you?
Did this KB article help you?

How would you rate your Now Support digital experience?

*

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

What can we improve? Please select all that apply.

What are we doing well? Please select all that apply.

Tell us more

*

Do you expect a response from this feedback?

  • Terms and conditions
  • Privacy statement
  • GDPR
  • Cookie policy
  • © 2025 ServiceNow. All rights reserved.