Log Export Service release notes

  • Release version: Store
  • Updated June 11, 2026
  • 4 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Log Export Service release notes

    The Log Export Service (LES) is a ServiceNow application designed to streamline the export and management of log data across various sources. It supports connectivity options such as Kafka and Splunk Connect for Kafka, enabling customers to push log events from ServiceNow to external log analytics platforms. LES has evolved through multiple releases since its initial version in November 2022, continuously enhancing setup ease, audit coverage, role-based access, and operational visibility.

    Show full answer Show less

    Key Features

    • Automated Configuration: Since version 3.5.0, LES automatically configures default log sources (syslog and sysaudit) upon plugin activation, reducing initial setup time and ensuring a consistent baseline.
    • Expanded Audit Log Support: LES now includes support for sysauditdelete and sysauditrelation log sources, allowing comprehensive audit coverage for deletion and relational data changes, which is critical for compliance.
    • Improved MID Server Integration: Guided setup tools and connectivity validations have been enhanced, including support for Hermes-based MID server configurations and network connectivity testing directly from the ServiceNow UI.
    • Granular Access Control: Role-based access controls allow delegation of LES administration with feature-specific roles without requiring full platform admin rights, improving security and operational management.
    • Operational Metrics and Reporting: LES exposes operational metrics in the Vault Console for seamless monitoring of export health and throughput. Detailed reports support drill-down analysis by time and log source over extended periods (up to 395 days).
    • Topic Management: Customers can create and assign topics to various log sources, including the ability to separate log events into different Kafka topics, enabling flexible and efficient log data organization.
    • Performance and Stability Enhancements: Updates address operational reliability during Hermes service slowness, reduce unnecessary logging noise, and improve MID Server consumer stability and scalability.

    What Customers Can Expect

    • Faster and Consistent Setup: Automated default configurations and updated guided setup processes minimize manual configuration effort and errors.
    • Enhanced Compliance and Audit Readiness: Extended audit log sources help meet regulatory requirements concerning deleted records and relational changes.
    • Improved Monitoring and Visibility: Integration of LES metrics into the Vault Console centralizes security posture monitoring, reducing context switching for administrators.
    • Flexible and Secure Administration: Enhanced role-based access enables secure delegation, supporting organizational governance.
    • Scalable and Reliable Log Export: Support for multiple consumers running in parallel and performance guidelines ensure reliable log export at scale.
    • Comprehensive Reporting: Access to detailed consumption and export reports helps customers analyze data transfer volumes and source-specific activity.

    Version history for the Log Export Service on the ServiceNow Store.

    Important:
    For details on system requirements and family compatibility, view the application listing on the ServiceNow Store website.

    Version history

    Version 3.5.0 - June 2026
    • What's New:
      • Auto-Configuration of Default Log Sources on Plugin Activation Log Export Service now automatically configures syslog and sys_audit as default log sources when the LES plugin is activated. Previously, administrators had to manually configure these sources after activation. This reduces post-install setup time and ensures a consistent baseline configuration out of the box.
      • LES Metrics Visibility in Vault Console New APIs expose LES operational metrics directly within the Vault Console. Security administrators can now view export health, throughput, and connectivity status alongside other platform security posture data without context-switching to a separate LES admin view. This closes a key dependency (DEP0046129) required for the Vault Console integration.
      • Extended Audit Log Source Support: sys_audit_delete and sys_audit_relation LES now supports two additional audit log source types: sys_audit_delete (records of deleted records) and sys_audit_relation (relationship-level audit changes). This expands audit coverage for customers with compliance requirements around deletion and relational data changes, and addresses a request from SAP customers.
      • Updated Guided Setup for MID Server Connectivity (Hermes) The LES guided setup flow has been refreshed to include an updated connectivity check for Hermes-based MID server configurations, improving clarity and reducing friction during initial setup and re-configuration.
    Version 3.4.0 - March 2026
    • New:
      • Introduced network connectivity validation UI action for MID Server, enabling one-click Kafka cluster connectivity testing directly from the ServiceNow interface without requiring manual network commands in the MID Server environment.
      • Published MID Server performance guidelines for Log Export Service, including validated scalability thresholds and capacity planning recommendations.
    • Changed: Enhanced granular role-based access control across Log Export Service, enabling delegation of LES administration through feature-specific roles (sn_logstoanalytics.admin) without requiring full platform admin privileges.
    • Fixed: Enhanced Log Export Service to maintain reliable operations during Hermes service slowness, without impacting instance stability.
    Version 3.3.0 - August 2025
    • New:
      • Enhanced Logs Exported reports with intuitive drill-down from month to week to day, source-level breakdown, and support for 395 days of data.
      • Enable multiple LES consumers to run in parallel across different topics without conflict or failure.
    • Fixed:
      • Removed unnecessary informational logs being continuously generated by the MID Server LES consumer.
      • Fixed a bug where selecting an existing topic during consumer creation caused an error, and selecting a correct new topic did not create the expected record.
      • The system property sn_logstoanalytics.debug is now disabled by default to prevent unnecessary debug logs in node logs.
      • Fixed an issue where updating existing syslog log source records to sys_audit did not remove associated log source topic and logger configuration records.
    Version 3.2.0 - May 2025
    • New: Added the ability to set different filters for the syslog source and assign the log source configuration to different topics.
    • Fixed: Resolved an issue where consumer context records were not deleted properly when cloning an instance with a MID server configuration.
    Version 3.1.0 - February 2025
    • New: The capability to create and name the topics, as well as assign various sys_audit tables to each topic.
    • Fixed: System log filters not applied accurately while pushing system log events to the Hermes topic.
    Version 2.2.3 - November 2024
    New: Option to store log events from each log source into a separate Kakfa topic in Hermes Messaging Service.
    Version 3.0.6 - August 2024
    • New:
      • New data consumption report that shows how much data has been copied to Hermes Messaging Service per each log source
      • Option to store log events from each log source into a separate Kakfa topic in Hermes Messaging Service.
      • Added description to sys_logger_configuration record
    Version 2.2.1 - May 2024
    • This is a minor release with a small number of user experience improvements including:
      • The organization of Log Export Service pages in the universal navigation dropdown has been improved
      • The status details information in the Consumer page has been moved to its own page called Consumer Status
    Version 2.1.0 - November 2023
    • New:
      • Added two new Guided Setup tools to the App to help cutomers complete the initial setup with step by step instructions and guidance.
      • One Guided Setup tool is for the MID Server integration option and the other for the Kafka Consumer option.
    Version 2.0.1 - August 2023
    New:
    • New functionality with Log Export Service v2
    • Added support for leveraging dedicated MID Server to easily connect to ServiceNow cloud and then push log events to your own log analytics tool via standard REST protocol.
    Version 1.0.4 - May 2023

    Improvements for ServiceNow cloud internal reporting purposes.

    Version 1.0.3 - January 2023
    Fixed: Security fix
    Version 1.0.1 - November 2022
    • First version of this service; we plan to add more connectivity options and log sources in future versions.
    • Supports the following connectivity options:
      • Kafka native
      • Splunk Connect for Kafka
    • Supports the following system and application log sources:
      • System Log Tables
        • syslog table
        • syslog_transaction table
      • Audit Table
        • sys_audit table
      • Node Log Files
        • localhost files (for all nodes)
    • Supports filters to reduce log source export size.
    • Provides report and analytics for log sources data size.