Description

---

At any time there is a need to review specific user behavior, below are the recommended steps on how to review the transaction logs and event logs:

• Locate the IP address of successful/failed login for a particular ServiceNow user for their instance
• Modify the time frame of the search
• Limiting the scope of search by user name
• Successful/Failed login attempts

Procedure

---

Locate User Activity Process Steps

1. Log into the instance as admin
2. Identify Transaction Logs
   • Transaction logs by default are kept for over 49 days unless the instance admin has adjusted the table rotations for [syslog_transaction] table.
3. Navigate to System Logs > Transactions https://<instance_name>.service-now.com/syslog_transaction_list.do
4. Adjust filter to narrow down logs for investigative purposes
   • Required timeframe: The filter is "Created"
   • Username: The filter set as "Created by" with the option of "starts with" either/or "contains"
     
     
     
     
5. Narrow the log date range
   
           From this list view we can then adjust the filter as below:
   • Created on – Adjust do any date or timeframe the customer needs
   • Created by – Adjust to the affected username
     
     
6. Identify the IP address of the user login:
   
   1. Click on cog wheel in the upper left corner of the table to open the Personalized list column. 
      
      
      
      
   2. To view the IP address of the logged in user you can add the IP address column to the list view via the Personalize List columns module. 
      
      

---

Identify Successful/Failed Login Attempts

 Note that this is only for local accounts.

1. Log into the instance as an admin
2. Navigate to System Logs > Events
   
   https://<instance_name>.service-now.com/sysevent_list.do?sysparm_query=sys_created_onONToday%40javascript:gs.daysAgoStart(0)%40javascript:gs.daysAgoEnd(0)%5EGOTOnameSTARTSWITHSNC.Auth.DB
   
   
3. Adjust filter as below:
   
   
   
   
   
4. From this list view we can then adjust the filter as below:
   • Created on – Adjust do any date or timeframe the customer needs
   • Created by – Adjust to the affected username

Applicable Versions

---

This is applicable to all versions.