To monitor which users are performing impersonations in a ServiceNow instance, administrators can activate the system property glide.sys.log_impersonation. When enabled, this property logs impersonation activities in the system logs, providing full traceability of who is impersonating whom.
Here's how it works:
By default, impersonation is not logged unless this system property is explicitly activated.
Once enabled, all impersonation activities are recorded in the syslog table (System Log > All), making it easy to track when and by whom impersonations were performed.
This helps in security audits and compliance tracking, ensuring that only authorized users impersonate others in the system.
🔹 Steps to Enable Logging of Impersonations:
Navigate to System Definition > System Properties.
In the filter navigator, search for glide.sys.log_impersonation.
Set the value to true.
Save the changes.
🔹 Alternative Verification Methods:
Check logs manually: Navigate to System Logs > All and filter logs by message containing "impersonation".
Audit the impersonation role assignments under System Security > Roles.
📌 Reference:
ServiceNow KB Article: KB0717055 - How to Log Impersonations
ServiceNow Docs: Logging and Monitoring in ServiceNow