KB2738915: Does sys_logger_configuration creation require syslog_admin or only admin?

[Jeff Boltz1]

We're implementing the Log and Allow assessment process for the Dot-Walk Scoping Security Enhancement and I'm trying to clarify the permissions required by Step 2 of KB2738915.

Specifically, Step 2 includes the"Script to create new Logger Configurations."

In our instance, a user with admin was unable to create the required sys_logger_configuration records, including when running the prescribed script in Global scope. A canCreate() check against sys_logger_configuration returned false.

During a ServiceNow Support investigation, we were advised that the missing role was syslog_admin, and Support used elevated privileges to create the required logger configuration. We were also advised that the syslog_admin requirement is not stated directly in KB2738915.

More recently, however, we've received different guidance indicating that a normal instance administrator should be able to run the Step 2 script in Global scope successfully without additional access.

I'm trying to determine the expected platform behavior rather than troubleshoot a particular instance.

For an Australia-or-later instance:

1. Should a user with admin, but withoutsyslog_admin, be able to execute the KB2738915 Step 2 script and create the required sys_logger_configuration records?
2. If canCreate() on sys_logger_configuration returns false for that administrator, is that expected because syslog_admin is required, or does it indicate some other configuration/access issue?
3. Does running the script in the Global application scope change the applicable create ACL/role requirement?

I'm specifically interested in the expected access behavior of sys_logger_configuration for the KB2738915 procedure.

Thanks.