ServiceNow supports two types of impersonation logging: interactive and non-interactive sessions.
Interactive sessions are impersonations performed through the user interface (UI).
Non-interactive sessions are impersonations executed by applications, background jobs, or scripts.
To ensure interactive impersonation sessions are recorded in the impersonation logs, set the system property:
glide.sys.log_impersonation = true
(If this property does not exist in your instance, it must be created.)
To capture non-interactive impersonation sessions, enable the following system property:
glide.sys.log_impersonation.non_interactive = true
(Similarly, create this property if it does not already exist.)
Once enabled, all impersonation start and end events can be found in the System Log, where the log Source is Impersonate.
You can even configure the out-of-the-box impersonation notification by following these steps:
Navigate to All > System Security > System Monitoring Console > Security Event Notifications.
Click on "Send notification on impersonation".
In the Conditions section, configure when the notification should be triggered:
Any User – triggers the notification for impersonation of all users,
orSpecific User(s) – triggers only when selected users are impersonated.
Any Role – triggers the notification regardless of the impersonated user’s role,
orSpecific Role(s) – triggers only when the impersonated user has specific roles.
Configure the Notification section by specifying:
The notification to be sent
The intended recipients (specific users or groups)
While this out-of-the-box setup effectively notifies user(s) and group(s) when impersonation starts, it does not provide a corresponding notification when impersonation ends.
I hope this helps , if so, please mark it as helpful.
Regards,
Sri Vardhan
