Issue
Identity Center (com.snc.identity_center) is a collection of user attributes, access, devices, login history, security activity, and much more which is available from U+. Data is stored on the sys_user_login_history table on the instance.
We have a lot of this information available with the module User Experience Analytics application.
Tracking Users in User Experience Analytics
ServiceNow Hosted videos on User Experience analytics
https://www.youtube.com/watch?v=Hu67rryv2cg
https://www.youtube.com/watch?v=53FwlOCOrWI
Informative KB's on Usage Analytics Dashboard
User Experience Analytics (Appsee) DATA & Hashed User ID FAQ
FAQ: User experience analytics dashboard-related information.
Multiple system tables/logs track a lot of information, and below is a workaround for achieving this if you need more custom data or information. At any given time, you can get this data from the instance only for a month ( from the log tables, which are not available for reporting).
If you have a reporting requirement, you might have to set up a custom solution that pulls these data onto a custom table for reporting.
This KB outlines All the logs in ServiceNow
**** The steps outlined below are a custom option to get more detailed custom information and this should be tested on your SUB PROD instances and you should also weigh in the performance impact while implementing this on PROD as every instance is different and there is no way to benchmark this.
Resolution
There is a last login time field on sys_user record which reset every time the user login to the instance. So if you are after the users who logged in in the last 30 days, you can create a filter for that field for your requirement.
https://<instancename>.service-now.com/sys_user_list.do?sysparm_query=last_login%3E%3Djavascript%3Ags.dateGenerate('2023-01-01'%2C'end')&sysparm_view=
There are two log tables that store this information. The instance's administrator can retrieve this information from these log tables.
- syslog_transaction table:
This table is not available/recommended for reporting (more details on Transaction Logs).
https://<instancename>.service-now.com/syslog_transaction_list.do?sysparm_query=urlSTARTSWITH%2Flogin.do%3F&sysparm_view=
*** This query can be used and can be really slow on your instance. Make sure you are doing this during low activity hours, in your instance.
Search for "login.do" in the above URL, and if there is an SSO login on your instance; the URL will be different and that is what you need to search for as the string parameter. Created By field will be the username who has logged in. - sysevent table
The information you are looking for is captured on the sysevent table which is a system table. This table is not available/recommended for reporting and it has an out-of-the-box auto-rotation enabled every 7 days.
More info on the events table is in this documentation.
Your internal developers can implement a custom solution that can be set up for historical reporting from a custom table.
Related Links
For historical custom reporting:
The sysevent table will only have the last 7 days of data. To get the information you are looking for, you must create a customized script on a sysevent table to capture the required information to a custom table of your choice and use that table for reporting.
If you use a real-time Business Rule, it can create a lot of load on the instance as this is one of the busiest/frequently accessed system tables of the instance platform.
You can plan for a scheduled custom script that pulls the required information once a day during your NON-business hours. This can pull the required information (columns/data required) daily into the custom table of your choice and be used for reporting.
https://instancename.service-now.com/sysevent_list.do?sysparm_query=name%3Dlogin%5EORname%3Dlogout
- Name ==> login/logout
- Instance==> Session ID of the user
- Parm 1==> Username
- User id ==> sys_id of the user
- Username
- Claimed By ==> Node on which the user was logged.
- Created ==> timestamp of Login/logout activity
