System log

  • Release version: Zurich
  • Updated July 31, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of System log

    The System log in ServiceNow Zurich release provides a centralized view of warnings, errors, and non-critical events related to instance processes, records, and system activity. It is essential for monitoring activities such as workflows, configuration changes, chat sessions, emails, imports, integrations, and system upgrades. Logs are limited to the current day by default, with older logs accessible via the log file browser.

    Show full answer Show less

    Key Features

    • Log Categories: Tracks various system activities including workflows, transactions (with performance metrics), inbound/outbound emails, and system events.
    • Severity Levels: Messages are classified as Debug, Information, Warning, or Error, helping prioritize investigation and response.
    • Source Identification: Each log entry includes the originating process or area (e.g., EMAIL, Memory) and associated application package.
    • Workflow Logging: Detailed tracking of workflow activities including start/end times, states, results, faults, transition history, and log statements.
    • Configuration Change Logging: Records details of configuration changes such as action type (insert, update, delete), comments, user info, XML differences, and related update sets.

    Key Outcomes

    • Enables ServiceNow customers to monitor system health and diagnose issues by reviewing detailed log data.
    • Facilitates troubleshooting by providing context-specific severity levels and filtered views based on message source and type.
    • Supports audit and compliance efforts through comprehensive tracking of workflow executions and configuration changes, including who made changes and when.
    • Helps maintain system stability by identifying errors and warnings that may impact operations, even when they do not require immediate action.

    View warnings and errors for instance processes, records, and non-critical events, such as memory usage on the server machine.

    The following information is tracked in the system log:

    • Workflows
    • Configuration
    • Chats sessions
    • Transactions for each view of each page in the system, including load times for network, server, and browser
    • Inbound and outbound email
    • Events triggered in the system
    • Imports and integrations
    • System warnings, errors, and script logs
    • Upgrade information for any plugin activations, update sets, or system upgrades

    Log entries appear for the current day only. To view other log files, use the log file browser.

    Syslog messages serve diagnostic and maintenance purposes. Log messages can have different owners and may not require action from all readers. Check the message source to determine relevance and ownership. The following fields describe the attributes of each message.

    Table 1. System log
    Field Description
    Created Date and time of the logging activity for the locale of the machine running the instance.
    Level The severity classification of the message. Levels indicate the nature of the event, not necessarily whether action is required. Messages are generated by the ServiceNow platform, installed applications, and custom scripts. The levels are Debug, Error, Warning, and Information.
    • Debug: Detailed diagnostic information, typically used during development or active troubleshooting.
    • Information: Confirmation that an operation completed as expected.
    • Warning: An unexpected condition was encountered, but the operation completed successfully. May require investigation depending on context and source.
    • Error: An operation failed or could not complete as intended. Instances can generate a high volume of Error messages, primarily from the platform itself. These do not necessarily indicate a platform issue and do not always require further investigation.
    Message System-generated message regarding the nature of the occurrence.
    Source Name of the process or area affected by the occurrence. For example, the source of the occurrence might be EMAIL or Memory.
    Source Package Name of the application package associated with the occurrence. Select the name to view the Store Application [sys_store_app] record for this package.

    Workflow logging

    • Each activity executed, including:
      • Date and time started
      • Date and time ended
      • State, for example, Finished, Cancelled, Timed Out, Error
      • Result
      • Fault description, if there was an error
    • Transition history, including:
      • Time of transition
      • Activity transitioned from
      • Activity transitioned to
      • Which transition was triggered
    • Workflow log, including any log statements added to the workflow

    Configuration information

    • Action taken, including insert, update, and delete
    • Category of change
    • Comments recorded with the change
    • Name of the change
    • XML difference of the change
    • Update set associated with the change
    • Date and time of the change
    • User who made the change
    • Table where the change was made
    • Name of the object being changed
    • Type of object being changed
    • View in which the change was made, for form or list changes