---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# View live CI data with Agent Client Collector

# View live CI data with Agent Client Collector {#ariaid-title1}

* Release version: Yokohama
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

View live data for incident-related CIs through Agent Client Collector for information that can help resolve the incidents.

## Before you begin

* Collecting running processes for a macOS system requires `sudo` privileges. If `sudo` privileges aren't granted, only processes run by the Agent Client Collector are collected.

  To enable `sudo` privileges for osqueryi, add the following strings to either the /etc/sudoers file or to an individual file in
  the /etc/sudoers.d directory:
  * `Cmnd_Alias LIVE_CI_VIEW = /Library/Application\ Support/servicenow/agent-client-collector/osquery/bin/osqueryi`
  * `_servicenow ALL=(ALL) NOPASSWD:LIVE_CI_VIEW`
  {#acc-live-ci-view__ul_qnv_fcw_fvb}
* To enable the OSQuery executable to retrieve information on logged-in users in a Windows environment, the agent must run as a local SYSTEM account.
{#acc-live-ci-view__ul_pnv_fcw_fvb}

Verify that you have installed Agent Client Collector Framework and Service Operations Workspace on your instance.

Role required: itil

## Procedure

1. Navigate to WorkspacesService Operations Workspace.
2. Select the Lists icon (![Lists icon]()).
3. Select IncidentsAll.
4. Select an incident from the list.
5. On the \<name of incident\> form, select the Live CI Data tab.  
   The CI data is displayed in the cards described in the following table.{#acc-live-ci-view__table_v35_3qv_hsb__entry__2}

   | Card | Description |
   |-|-|
   | Device details | General details about the CI. |
   | Memory Usage | Amount of memory being used by the CI. |
   | Top 5 running processes by CPU usage | The five CI processes using the most CPU. |
   | Top 5 running processes by memory usage | The five CI processes using the most memory. |
   | Disk Usage % | Percentage of disk space in use on the CI. |
   | Logged-in users | Users logged in to the CI. Whether this data is visible depends on your OS privileges. * MacOS: Requires sudo privileges * Windows system: Requires administrator privileges * Linux: No special privileges are required {#acc-live-ci-view__ul_qkm_jsv_hsb} |
   [Table 1. Live CI Data tab cards]

   {#acc-live-ci-view__table_v35_3qv_hsb}
**Related tasks**   

* [View live CI data logs](https://servicenow-prod.fluidtopics.net/mTsB7lJNa8yOpMPimv3g8Q "View CI logs to receive additional details on an incident when viewing live CI data. For example, viewing log information for a process with high CPU usage can help you pinpoint when the usage went up, helping you determine the root cause of the issue.")
* [Assign a CI to an incident to view live CI data](https://servicenow-prod.fluidtopics.net/nL9B3sI3_CGg5uA26zF58g "Retrieve live CI data to help troubleshoot the issues that caused an incident by assigning the problematic CI to its incident. An incident typically is associated with the CI that caused the incident, but if this was omitted during the incident creation, you can assign the CI manually.")

*[\>]: and then