Skip to page contentSkip to chat
ServiceNow support
    • Community
      Ask questions, give advice, and connect with fellow ServiceNow professionals.
      Developer
      Build, test, and deploy applications
      Documentation
      Find detailed information about ServiceNow products, apps, features, and releases.
      Impact
      Accelerate ROI and amplify your expertise.
      Learning
      Build skills with instructor-led and online training.
      Partner
      Grow your business with promotions, news, and marketing tools
      ServiceNow
      Learn about ServiceNow products & solutions.
      Store
      Download certified apps and integrations that complement ServiceNow.
      Support
      Manage your instances, access self-help, and get technical support.
Attempting to use the sys_audit table table to monitor user activity - Support and Troubleshooting
  • >
  • Knowledge Base
  • >
  • Support and Troubleshooting (Knowledge Base)
  • >
  • Attempting to use the sys_audit table table to monitor user activity
KB0786168

Attempting to use the sys_audit table table to monitor user activity


14659 Views Last updated : Apr 8, 2024 public Copy Permalink English (Original)
  • English (Original)
  • Japanese
KB Summary by Now Assist

Issue

For various reasons you may have a business requirement to track user activity within the platform such as to confirm actions that have or have not been taken by specific users.

Having reviewed available OOTB data the sys_audit table might initially look like a good solution to this requirement but in reality there are several limitation that should be reviewed first.

Resolution

As described within the official documentation the audit functionality within the ServiceNow platform is designed to:

"Track record changes on auditing-enabled tables. By default, the system tracks changes to the incident, change, and problem tables, among others."

Key to this statement is that it only records audit data for 'enabled' tables and furthermore you can also specify fields that are not audited

This highlights the biggest reason not to use sys_audit to track user actions:

  • Any update to a table or field that is not configured for auditing will not be recorded and cannot be reported on

As such, while it might highlight some information on user activity, it will not provide the full picture

Supplementary to this are two other issues that need to be considered:

  • It is not sustainable to configure auditing on all tables & fields due to the potential volume of retained data
  • Out of the box the sys_audit table is only intended to be queried in specific ways, so reports on user activity may be very slow due to a lack of supporting indexes

Alternative Approaches

The best implementation of a feature of this nature would require customisation of your instance to suit your business requirement exactly

One option could be to review the creation of business rules designed to create custom events when monitored actions occur, for example creation of a incident.

These could then be processed to generate entries into a custom activity table designed to specifically for your reporting needs

ServiceNow Professional Services teams are always available to assist with the development of customised solutions such as this, and can be contacted via your Account Manager to discuss in further detail

Related Links

Additional information on the Audit feature is available in the following product documentation:

https://docs.servicenow.com/csh?topicname=audited-tables-2.html&version=latest


The world works with ServiceNow.

Sign in for more! There's more content available only to authenticated users Sign in for more!
Did this KB article help you?
Did this KB article help you?

How would you rate your Now Support digital experience?

*

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

What can we improve? Please select all that apply.

What are we doing well? Please select all that apply.

Tell us more

*

Do you expect a response from this feedback?

  • Terms and conditions
  • Privacy statement
  • GDPR
  • Cookie policy
  • © 2025 ServiceNow. All rights reserved.