There are two log tables that store this information. The instance's administrator can retrieve this information from these log tables.
(Opening the below table may slower the perfomance so take necessary action on lowerinstace first/business hours etc in check)
- syslog_transaction table:
This table is not available/recommended for reporting (more details on Transaction Logs).
https://<instancename>.service-now.com/syslog_transaction_list.do?sysparm_query=urlSTARTSWITH%2Flogin.do%3F&sysparm_view=
*** This query can be used and can be really slow on your instance. Make sure you are doing this during low activity hours, in your instance.
Search for "login.do" in the above URL, and if there is an SSO login on your instance; the URL will be different and that is what you need to search for as the string parameter. Created By field will be the username who has logged in. - sysevent table
The information you are looking for is captured on the sysevent table which is a system table. This table is not available/recommended for reporting and there is an out-of-the-box auto-rotation enabled on this every 7 days.
More info on the events table is in this documentation.
Your internal developers can implement a custom solution that can be set up for historical reporting from a custom table.
For historical custom reporting:
The sysevent table will only have the last 7 days of data. To get the information you are looking for, you must create a customized script on a sysevent table to capture the required information to a custom table of your choice and use that table for reporting.
If you use a real-time Business Rule, it can create a lot of load on the instance as this is one of the busiest/frequently accessed system tables of the instance platform.
You can plan for a scheduled custom script that pulls the required information once a day during your NON-business hours. This can pull the required information (columns/data required) daily into the custom table of your choice and be used for reporting.
https://instancename.service-now.com/sysevent_list.do?sysparm_query=name%3Dlogin%5EORname%3Dlogout
- Name ==> login/logout
- Instance==> Session ID of the user
- Parm 1==> Username
- User id ==> sys_id of the user
- Username
- Claimed By ==> Node on which the user was logged.
- Created ==> timestamp of Login/logout activity
I hope this helps 🙂