--- sourceDocument: Brazil Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security Release : - brazil ft:locale : - en-US ft:publication_title : - Brazil Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Actions and roles # Log Export Service actions and required roles {#ariaid-title1} Release version: Brazil Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Log Export Service uses role-based access control to restrict actions to authorized users. ## Role-based access control {#les-actions-roles__section_overview} Log Export Service uses role-based access control so that only authorized users can perform specific actions. The following table maps Log Export Service actions to the roles required to perform them.{#les-actions-roles__les-actions-roles-para-1} Unless otherwise noted, any one of the listed roles is sufficient to perform the action.{#les-actions-roles__les-actions-roles-para-2} ## Log Export Service roles {#les-actions-roles__section_role_hierarchy} Log Export Service includes the following three primary roles:{#les-actions-roles__les-actions-roles-para-3} sn_logstoanalytics.admin : Application administrator role. Installed with the Log Export Service application and allows a non-admin user to configure and use Log Export Service. admin : System administrator role. Required to install the Log Export Service Store application and to perform platform-level setup tasks. hermes_admin : Required to generate the certificates that secure the connection between Log Export Service and the Hermes Messaging Service. {#les-actions-roles__table_les_actions__entry__4} | Action | Description | Required roles | Component | |-|-|-|-| | Initial setup and configuration |||| | Install Log Export Service application | Install Log Export Service from the ServiceNow Store. | admin | Instance | | Review Hermes Messaging Service diagnostics | Verify that the Hermes Messaging Service is running, check connectivity, and view topics. | admin | Instance | | Run Kafka consumer guided setup | Step through the initial configuration of Log Export Service for an external Kafka consumer. | admin | Instance | | Run MID Server consumer guided setup | Step through the initial configuration of Log Export Service for a dedicated MID Server consumer. | admin | Instance | | Log source configuration |||| | Create a log source configuration | Regulate and set filters on the logs to be forwarded by creating a source record for each log source. | admin or sn_logstoanalytics.admin | Instance | | Create source type and multiple topics | Consume logs for each source type by creating multiple Kafka topics. | admin or sn_logstoanalytics.admin | Instance | | Validate Log Producer | View live log records in a topic by using the Hermes Topic Inspector. | admin or sn_logstoanalytics.admin | Instance | | Kafka consumer configuration |||| | Generate certificates for Hermes secure connection | Generate the certificates required to authorize a client that pulls logs from the Hermes Messaging Service. | admin or hermes_admin | Instance | | Configure Kafka consumer processes | Create consumer processes with separate bootstrap addresses to connect to both Hermes Kafka clusters for failover. | admin | External Kafka | | Verify Kafka consumer pulling logs | Verify that the chosen Kafka consumer can pull log events from the Hermes Messaging Service. | admin | External Kafka | | MID Server consumer configuration |||| | Install and validate dedicated MID Server | Install a MID Server dedicated to Log Export Service, and validate it to enable it to execute automation tasks. | admin | Both | | Add MID Server properties for Hermes | Configure properties that establish the Kafka connection between the MID Server and the Hermes Messaging Service. | admin | Instance | | Configure Log REST push destination | Create a Destination Configuration record that defines the REST endpoint that the MID Server Extension forwards logs to. | admin or sn_logstoanalytics.admin | Instance | | Configure LES Consumer Context | Update the LES Consumer MID Server Extension record to execute on the dedicated MID Server installed for Log Export Service. | admin | Instance | | Configure Consumer | Create a Consumer record specifying the Hermes topic to retrieve logs from and the destination configuration to relay them to. | admin or sn_logstoanalytics.admin | Instance | | Test MID Connection | Verify connectivity from the MID Server environment to the Hermes cluster. | admin or sn_logstoanalytics.admin | Instance | | Verify MID Server integration | Monitor the Consumer Status view to confirm the MID Server process is relaying messages to the REST endpoint. | admin or sn_logstoanalytics.admin | Instance | | Administration and monitoring |||| | Update the glide.les.disable_logs_forwarding system property | Pause or resume Log Export Service log forwarding during migration or database reseeding operations. | admin | Instance | | Review log report dashboard | Analyze the size of each data log and consumption metrics across Log Export Service sources. | admin or sn_logstoanalytics.admin | Instance | [Table 1. Log Export Service actions and required roles] {#les-actions-roles__table_les_actions} **Related reference** * [Log Export Service roles](https://www.servicenow.com/docs/JxgYoavQKOaN6YMyClL4Nw "Log Export Service is installed with these roles.") * [Properties installed with Log Export Service](https://www.servicenow.com/docs/W6jih0Re8yJeh034bXAubA "Log Export Service (LES) adds the following instance system properties and MID Server properties.")