Understanding "User Agent" in Client Transaction Log

[adityavishnu]

Hi All,

I am trying to figure out which browser did the End User use by looking at the Client Transaction Log. I noticed a field "User Agent" which says

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR

and another which said

Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94

Both of them have Mozilla in common but IE in the former and Chrome in the latter. Would that mean Internet Explorer for the first one and Chrome for the Second one? How do i confirm which browser was used ?

My other concern is in the URL of Client Transaction Log there is an argument

sys_target=sc_req_item&sysparm_list_css&sys_id=-1&sysparm_target&sysparm_nameofstack=6d734d364f57d6008186e6101310c7b0

i believe this is the sys id (its 32 bit) of something. How to find what it is ? I checked in the sc_req_item table but did not find any.

Thank You,

Aditya

[Jace Benson]

This is something I've spent some time trying ti figure out how to better identify usage of browsers.   Google Analytics is great at this, but we aren't google and all you have is the User Agent string (which can also be spoofed).

I'm going to refer you this site about user agents UserAgentString.com - Java version 1.8.0_31

That site has tons of user agents but sometimes you'll have versions that don't line up.

However you user agents you shared line up

IE9 = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR

Chrome 50.0.2661.94 = Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94

If you find a way to easily trend this data do me a favor and post it on share.service-now.com

I believe the send part of this is just understanding the transaction itself;

sys_target=sc_req_item&sysparm_list_css&sys_id=-1&sysparm_target&sysparm_nameofstack=6d734d364f57d6008186e6101310c7b0

So I believe and I don't think its documentmented (or at least not well) that this is someone clicking a link to a new sc_req_item.

sys_id=-1 is always a new record.   I'm not sure what the sysparm_nameofstack is perhaps that has to do with their session (you could probably find out by doing some logging of gs and find out but I'm not sure.

Hopefully this is helpful.

[Chris14]

Hi all,

i know is an old thread but i just wanted to highlight, that this field is just 100 characters long and for example the current User Agent string of MS Edge exceed easily that amount. Consequence of that is, that every Edge browser appears as chrome browser simply because Edge comes somewhere after 100 characters and Chrome is part of the user agent string:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Edg/99.0.1150.39

compared to Chrome:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

[Jace Benson]

I never considered the limitations of the field's length.  Great call out Chris.