Log sources

concept australia Updated Sep 10, 2026 1 min read les-log-sources-export.md

Log Export Service (LES) can export log sources from some System Log Tables, Audit Tables, and Application Node Log Files.

LES can export the following log sources:

System Log Tables
- syslog: Warnings and errors for instance processes, records, and non-critical events such as memory usage
- syslog_transaction: View all browser activity for an instance
- sys_outbound_http_log: View all requests and responses for outbound web services such as REST and SOAP
Audit tables
- sys_audit: Record changes made to tables chosen to be audited
- sys_audit_delete: Snapshots produced when audited records are deleted
- sys_audit_relation: Changes to tracked reference fields on audited records
Workflow/Process logs: sys_flow_log records execution details and status of workflow processes
Security and authentication logs: sys_user_login_history tracks user login attempts and authentication events
Application node log files: Use the localhost log files to view application node errors. Your instance has multiple nodes and each node has multiple log files.

These log sources provide comprehensive visibility into system operations, user activity, and integration points. Export these logs to external systems for long-term retention, compliance auditing, or security analysis.

For detailed schema information and purposes for each log source, see System logs.

Parent Topic:Exploring Log Export Service (LES)

37 lines · 2.2 KB Wrap lines

---
title: Log sources
description: Log Export Service \(LES\) can export log sources from some System Log Tables, Audit Tables, and Application Node Log Files.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/les-log-sources-export.html
release: australia
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Explore, Log Export Service \(LES\), Platform Security]
---

# Log sources

Log Export Service \(LES\) can export log sources from some System Log Tables, Audit Tables, and Application Node Log Files.

LES can export the following log sources:

-   System Log Tables
    -   **syslog**: Warnings and errors for instance processes, records, and non-critical events such as memory usage
    -   **syslog\_transaction**: View all browser activity for an instance
    -   **sys\_outbound\_http\_log**: View all requests and responses for outbound web services such as REST and SOAP
-   Audit tables
    -   **sys\_audit**: Record changes made to tables chosen to be audited
    -   **sys\_audit\_delete**: Snapshots produced when audited records are deleted
    -   **sys\_audit\_relation**: Changes to tracked reference fields on audited records
-   Workflow/Process logs: **sys\_flow\_log** records execution details and status of workflow processes
-   Security and authentication logs: **sys\_user\_login\_history** tracks user login attempts and authentication events
-   Application node log files: Use the localhost log files to view application node errors. Your instance has multiple nodes and each node has multiple log files.

These log sources provide comprehensive visibility into system operations, user activity, and integration points. Export these logs to external systems for long-term retention, compliance auditing, or security analysis.

For detailed schema information and purposes for each log source, see [System logs](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/system-logs.md).

**Parent Topic:**[Exploring Log Export Service \(LES\)](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/les-landing-page.md)