Log Export Service release notes

  • Release version: Store
  • Updated June 11, 2026
  • 4 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Log Export Service Release Notes

    The Log Export Service (LES) on the ServiceNow Store enables customers to export system and application logs to external analytics and monitoring tools efficiently. It supports various log sources including system logs, audit tables, and node log files, with connectivity options such as Kafka and Splunk Connect for Kafka. LES provides features to filter logs, generate reports on log data size, and offers guided setup tools to simplify initial configuration and MID Server integration.

    Show full answer Show less

    Key Features

    • Automatic Configuration: Since version 3.5.0, LES auto-configures default log sources (syslog and sysaudit) upon plugin activation, reducing setup time and ensuring consistent baseline configurations.
    • Expanded Audit Log Coverage: Support for additional audit sources like sysauditdelete and sysauditrelation enhances compliance capabilities, particularly for customers needing detailed deletion and relational change logs.
    • Enhanced Connectivity and Setup: Guided Setup tools and updated connectivity checks streamline MID Server integration, including Hermes-based MID Server configurations.
    • Improved Metrics and Monitoring: LES operational metrics are now visible within the Vault Console, allowing security administrators to monitor export health, throughput, and connectivity alongside other security posture data.
    • Role-Based Access Control: Fine-grained LES administration roles allow delegation without granting full platform admin privileges, enhancing security and control.
    • Multiple Topics and Filters: Users can create and assign multiple topics for different log sources, set distinct filters, and run multiple LES consumers in parallel without conflict.
    • Network Validation: One-click Kafka cluster connectivity testing through the ServiceNow interface facilitates easier network validation.
    • Reports and Analytics: Detailed logs export reports support drill-down by timeframes and log sources, and data consumption reports show volume of logs pushed to Hermes Messaging Service.

    Key Outcomes

    • Faster and more reliable post-installation setup with automatic default log source configuration.
    • Improved audit log coverage meeting compliance requirements related to deletions and relationship changes.
    • Seamless integration and management of LES via MID Server with enhanced guided setup flows and connectivity validation.
    • Centralized visibility of LES operational metrics in the Vault Console reduces context switching and improves security monitoring.
    • Greater administrative control with granular roles tailored for LES features, enhancing security governance.
    • Flexibility to manage multiple log export topics and filters supports complex logging environments and scalability.
    • Enhanced troubleshooting and stability with fixes addressing consumer errors, debug log noise, and Hermes service slowness.

    Version history for the Log Export Service on the ServiceNow Store.

    Important:
    For details on system requirements and family compatibility, view the application listing on the ServiceNow Store website.

    Version history

    Version 3.5.0 - June 2026
    • What's New:
      • Auto-Configuration of Default Log Sources on Plugin Activation Log Export Service now automatically configures syslog and sys_audit as default log sources when the LES plugin is activated. Previously, administrators had to manually configure these sources after activation. This reduces post-install setup time and ensures a consistent baseline configuration out of the box.
      • LES Metrics Visibility in Vault Console New APIs expose LES operational metrics directly within the Vault Console. Security administrators can now view export health, throughput, and connectivity status alongside other platform security posture data without context-switching to a separate LES admin view. This closes a key dependency (DEP0046129) required for the Vault Console integration.
      • Extended Audit Log Source Support: sys_audit_delete and sys_audit_relation LES now supports two additional audit log source types: sys_audit_delete (records of deleted records) and sys_audit_relation (relationship-level audit changes). This expands audit coverage for customers with compliance requirements around deletion and relational data changes, and addresses a request from SAP customers.
      • Updated Guided Setup for MID Server Connectivity (Hermes) The LES guided setup flow has been refreshed to include an updated connectivity check for Hermes-based MID server configurations, improving clarity and reducing friction during initial setup and re-configuration.
    Version 3.4.0 - March 2026
    • New:
      • Introduced network connectivity validation UI action for MID Server, enabling one-click Kafka cluster connectivity testing directly from the ServiceNow interface without requiring manual network commands in the MID Server environment.
      • Published MID Server performance guidelines for Log Export Service, including validated scalability thresholds and capacity planning recommendations.
    • Changed: Enhanced granular role-based access control across Log Export Service, enabling delegation of LES administration through feature-specific roles (sn_logstoanalytics.admin) without requiring full platform admin privileges.
    • Fixed: Enhanced Log Export Service to maintain reliable operations during Hermes service slowness, without impacting instance stability.
    Version 3.3.0 - August 2025
    • New:
      • Enhanced Logs Exported reports with intuitive drill-down from month to week to day, source-level breakdown, and support for 395 days of data.
      • Enable multiple LES consumers to run in parallel across different topics without conflict or failure.
    • Fixed:
      • Removed unnecessary informational logs being continuously generated by the MID Server LES consumer.
      • Fixed a bug where selecting an existing topic during consumer creation caused an error, and selecting a correct new topic did not create the expected record.
      • The system property sn_logstoanalytics.debug is now disabled by default to prevent unnecessary debug logs in node logs.
      • Fixed an issue where updating existing syslog log source records to sys_audit did not remove associated log source topic and logger configuration records.
    Version 3.2.0 - May 2025
    • New: Added the ability to set different filters for the syslog source and assign the log source configuration to different topics.
    • Fixed: Resolved an issue where consumer context records were not deleted properly when cloning an instance with a MID server configuration.
    Version 3.1.0 - February 2025
    • New: The capability to create and name the topics, as well as assign various sys_audit tables to each topic.
    • Fixed: System log filters not applied accurately while pushing system log events to the Hermes topic.
    Version 2.2.3 - November 2024
    New: Option to store log events from each log source into a separate Kakfa topic in Hermes Messaging Service.
    Version 3.0.6 - August 2024
    • New:
      • New data consumption report that shows how much data has been copied to Hermes Messaging Service per each log source
      • Option to store log events from each log source into a separate Kakfa topic in Hermes Messaging Service.
      • Added description to sys_logger_configuration record
    Version 2.2.1 - May 2024
    • This is a minor release with a small number of user experience improvements including:
      • The organization of Log Export Service pages in the universal navigation dropdown has been improved
      • The status details information in the Consumer page has been moved to its own page called Consumer Status
    Version 2.1.0 - November 2023
    • New:
      • Added two new Guided Setup tools to the App to help cutomers complete the initial setup with step by step instructions and guidance.
      • One Guided Setup tool is for the MID Server integration option and the other for the Kafka Consumer option.
    Version 2.0.1 - August 2023
    New:
    • New functionality with Log Export Service v2
    • Added support for leveraging dedicated MID Server to easily connect to ServiceNow cloud and then push log events to your own log analytics tool via standard REST protocol.
    Version 1.0.4 - May 2023

    Improvements for ServiceNow cloud internal reporting purposes.

    Version 1.0.3 - January 2023
    Fixed: Security fix
    Version 1.0.1 - November 2022
    • First version of this service; we plan to add more connectivity options and log sources in future versions.
    • Supports the following connectivity options:
      • Kafka native
      • Splunk Connect for Kafka
    • Supports the following system and application log sources:
      • System Log Tables
        • syslog table
        • syslog_transaction table
      • Audit Table
        • sys_audit table
      • Node Log Files
        • localhost files (for all nodes)
    • Supports filters to reduce log source export size.
    • Provides report and analytics for log sources data size.