Servicenow Impersonate Query

[SH40171025]

How can we check who has impersonated our instance over a period of time?

Is there any way or any method to do access Impersonate counting's?

[Dr Atul G- LNG · Accepted solution]

Hi @SH40171025 

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0717055

[yella123 · Accepted solution]

To retrieve information about impersonation in your instance, follow these steps:

1. Navigate to "sys_properties.list"
2. Click New
3. Fill in the new property with the following values:
   
   • Name: glide.sys.log_impersonation
   • Type: true/false
   • Value: true
4. Save
5. Go back to "sys_properties.list" and show List view
6. Type "glide.sys.log_impersonation" in the Name column and press Enter to confirm the property has been added.
7. Perform a cache flush by typing "cache.do" in the navigator
8. Log out then Log in again

After logging back in, you can see the history of impersonation in a system log by:

1. Navigating to System log > All
2. Type "*impersona" in the Message column and press Enter
3. You will see the history of impersonations in the system log by looking for messages like:
   
   • "Impersonation start:"
   • "Impersonation end:"

[Chaitanya ILCR · Accepted solution]

Hi @SH40171025 ,

in addition to what @Dr Atul G- LNG has shared 

you can check the user preferences tables for each users impersonations 

where name = recent.impersonations

Please mark my answer as helpful/correct if it resolves your query.

Regards,
Chaitanya

[rcunning · Accepted solution]

Very useful. Thanks all!

[Dr Atul G- LNG · Accepted solution]

Please accept answers and close the thread.

[Dr Atul G- LNG · Accepted solution]

Please accept answers and close the thread.

[GlideFather · Accepted solution]

Hello @SH40171025,

I just tried in my client's instance and no system property is needed to create. The glide.sys.log_impersonation as per suggested KB is not existing in my client's and still you can check the logs.

Simply change your URI accordingly and navigate to:
https://your-instance.service-now.com/syslog_list.do?sysparm_query=sys_created_onONThis%20month%40ja...
(the query has applied filter for the last month, you can adjust it)

And you can see who impersonated for whom and when it was.

Search in the Sys Log for:
Impersonation start
Impersonation end

[frankeck]

Hi,

our issue with that is, on the syslog you shouldn't run reports, we need a way to export for audit reasons the impersonations. And the records in the isc_impersonation_event are kept for just 7 days, so currently our work around is that once week the data is exported to an excel spreadsheet.

Anyone have a better idea? I'm wondering that this isn't really kept in a seperate place and OOTB.