What does 'last login time' actually track on the user record?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎12-10-2018 10:24 AM
We are trying to track when a user has logged into the system. I added the field 'last login' time to the user record, and looked at the audit history for that field.
In that list, it is showing the user as logging in every few minutes or so, including a week when this user was out of the country, so it seems to be a little inaccurate. . I am curious what the system is actually counting as a 'login' in this case?
I've included a screenshot of the audit history of this use for just today as an example of why I think the data may be inaccurate. This user according to this logged in every ten minutes or so, and then two minutes after at one point. These listed "login" times also do not match with the system events login event.
I know you can track login events in the System logs > events list (which also doesn't seem to be reflecting correctly) but my question is what is this particular field I mentioned above tracking?
Thanks ahead of time!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎09-07-2023 08:47 AM
I am also seeing this problem, 2+ years after the last threaded reply. Does anyone have a more succinct explanation of why the "Last..." values are getting (mysteriously) updated for User records?

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎09-07-2023 10:15 AM
@William David I found this in one of the post:
Whenever a user is mentioned with '@' in any journal field(Additional comment/ work note), the system checks whether the mentioned user has read access to this particular field. To verify the same, the system impersonates the mentioned user at the backend which automatically updates the last login time of the user.
Please mark this as correct and helpful if it resolved your query or lead you in right direction.
https://www.servicenow.com/community/developer-forum/how-last-login-time-works/m-p/2432299#M947661