--- sourceDocument: Australia ServiceNow AI Platform Capabilities sourceDocumentLink: https://www.servicenow.com/docs/r/servicenow-platform Release : - australia ft:locale : - en-US ft:publication_title : - Australia ServiceNow AI Platform Capabilities ft:clusterId : - platcap bundleId : - platcap workflow : - Platform --- # MID Server command audit log # MID Server command audit log {#ariaid-title1} * Release version: Australia * * Updated March 12, 2026 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read The command audit log records the commands run by the MID Server for the Discovery application. Review the commands to check for anomalies or errors. |-| | | [ ] {#mid-audit-log__table_m2t_cv4_nhb} The MID Server command audit log is a record of the commands the MID Server runs during discovery. For example, executing one pattern may run many separate commands. The MID Server command audit log supports Powershell commands for WMI and WinRM. For SSH commands, the audit log supports SSNC but not J2SSH. In Quebec, the command audit log only supports recording the commands run during discovery. ## Enable the command audit log {#mid-audit-log__section_bgt_gwn_wnb} The MID Server audit log is enabled with the MID Server property mid.log.command_audit.enable, which is set to false by default. Add the property in the MID Server Properties table \[ecc_agent_property_list.do\]. Once enabled, the MID Server command audit logs are accessed in the instance by navigating to MID ServerCommand Audit Logs \[ecc_agent_command_audit_log_list.do\]. To see or change this table, the user must have the role agent_security_admin. ## Data recorded in the command audit logs {#mid-audit-log__id_sz2_rwn_wnb} The MID Server command audit log records the name of the command and the command hash. If, for example, during discovery a probe does not run a command but instead runs a script then the script name is recorded. The command hash is calculated based on the content of the script, regardless of the name. Therefore, changing the name does not affect the command hash. When a probe, such as a WMIRunner, runs a command with multiple WMI fields then WMI creates one script to query those fields. The script is created temporarily on the MID Server host in the temp folder. After the script is run, it is removed from the temp folder. The script is given a name based on the fields and a random number. However, the hash key is always the same given the same contents. The command audit log reports the execution status as either a success or failure. The record entry is a success if the command was run, or a failure if it was unable to run. The command audit log does not consider the result of the command being run. For example, a command which runs but fails gather data is still listed in the execution status as a success. Discovery supports JEA profiles for WinRM. The MID Server command audit log records the JEA profile of the discovery command, if it is available. See [Microsoft Just Enough Administration (JEA) for Discovery](https://www.servicenow.com/docs/access?context=microsoft-jea-discovery&version=australia&pubname=australia-it-operations-management&ft:locale=en-US) for more information on JEA profiles. By default, the table is rotated every seven days. For more information, see [Table Rotation](https://www.servicenow.com/docs/access?context=c_TableRotation&version=australia&pubname=australia-platform-administration&ft:locale=en-US). **Related concepts** * [MID Server certificate check policies](https://www.servicenow.com/docs/8m9x80nAaFWIF8NiDGXc_Q "MID Server uses four kinds of security checks to secure external traffic. The security checks use TLS/SSL certificate validation, hostname validation, Certificate Revocation List (CRL), and Online Certificate Status Protocol (OCSP) validation to improve security. Control these security checks with the MID Server certificate check policies table.") * [MID Server authentication credentials and SOAP requests](https://www.servicenow.com/docs/4p8crGngPgOAfdbk8pjYFg#mid-authentication-soap-requests "Set basic authentication credentials to update the web service invocation data. For added security, you can enforce basic authentication on each incoming SOAP request to the MID Server.") * [MID Server unified key store](https://www.servicenow.com/docs/3iLVsHlOfzGiZISJScyUqg#mid-unified-keystore "The MID Server unified key store allows all products on the MID Server to use common certificates and key pairs. This feature allows applications to use the same secure communication channel to the MID Server that the MID Server uses to connect to the instance.") * [MID Server FIPS Enforced Mode](https://www.servicenow.com/docs/6cyY5imUziFLEBVdeKF8Vg#mid-fips-enforced "The MID Server supports the National Security Cloud (NSC) IL-5 environment, which requires all utilized cryptography to be FIPS validated. The MID server can be run in FIPS Enforced Mode, where only cryptographic algorithms which are FIPS validated are utilized.") * [MID Server Governance](https://www.servicenow.com/docs/hKi3YlVuzrunJBBe22fUyA "Improve MID Server security by setting an automatic timeout to invalidate and shut down inactive MID Servers. You can enable this feature and set the inactivity timeout period globally and for each MID Server.") **Related tasks** * [Encrypt or decrypt MID Server configuration file values](https://www.servicenow.com/docs/G4CBpk2iPfTHLSDWAWDJ5g "The value of any MID Server parameter in the config.xml file can be encrypted. The attributes for all encrypted values are managed from within the configuration file, including the security attribute of the login password.") * [Enable MID Server mutual authentication](https://www.servicenow.com/docs/1x5Mg3ah2iZZJWtCmt7MHA "Configure the MID Server to use a client certificate for authenticating to the instance. This avoids the need to create a basic authentication credentials in the Key Store for the MID Server's configuration.") * [MID Server Azure Key Vault integration](https://www.servicenow.com/docs/h~EAcaKr8L7MtsoM1T1JZw#mid_azure_key_vault_integration "The MID Server integration with the Azure Key vault enables Orchestration, Discovery, and Service Mapping to run without storing any credentials on the instance.") * [Rekey a MID Server](https://www.servicenow.com/docs/cfw_kaXQmtxZLN_QCG2fMA "Rekey a MID Server to generate a new private key. Private keys are used to decrypt automation credentials, so that MID Servers can transmit information securely. Key pairs are initially generated when a MID Server is validated, and MID Servers should be rekeyed periodically to meet security requirements.") * [Add SSL certificates for the MID Server](https://www.servicenow.com/docs/8cWDoJ9T_h_b8ifC0ZkXbQ#add-ssl-certificates "Configure the MID Server to connect to a source over SSL.") * [Specify an external TrustStore for the MID Server](https://www.servicenow.com/docs/3RNiYmqV0dQbg~jmllLB_g "The MID Server JVM can utilize a TrustStore external to the MID installation directory so any certificates added to the TrustStore are not overwritten during an upgrade. It is important that this TrustStore file reside outside of the MID installation directory, and the Truststore location can be specified by adding additional parameters to the MID Server's wrapper-override.conf file.") * [Attach a script file to a file synchronized MID Server](https://www.servicenow.com/docs/DmB6BsY304iOeBhp4zOVQQ#mid-server-script-attach "You can attach a script file to synchronize to a connected MID Server.") **Related reference** * [MID Server configuration file security](https://www.servicenow.com/docs/Pqv4zoe2goe4CNWzxvGNvA "Sensitive MID Server configuration data can be protected using several different schemes, including internal and external data encryption and external data storage.") * [MID Server SSH cryptographic algorithms](https://www.servicenow.com/docs/om8pznVaWbn0m7PmSWW9UA "The MID Server utilizes SSH clients to perform many discovery actions. During the SSH handshake, both the client and server first determine which algorithms both parties support, then client picks the highest priority algorithm. For the Host Key Algorithm, the client picks highest priority algorithm which both parties support that matches the key type.") *[\>]: and then