Property reference

`mid.log.command_audit.enable`

The mid.log.command_audit.enable property activates the MID Server command audit log. Enabling this property allows users with the agent_security_admin role to track and review commands executed by the MID Server, which is crucial for security audits.

Default: Not stated
Type: Not stated
Application: Not stated

Key questions about this property

The answers below summarize the purpose, scope, default effect, and review scenarios for this property.

What does it do?	This property enables logging of commands run by the MID Server, capturing details such as command names, hashes, and execution status.
What area does it affect?	MID Server Command Auditing
What does the default mean?	No default value is stated in the ServiceNow documentation.
When should you review it?	An admin should review this property during security audits or when enabling command tracking for compliance.

Property record

Facts stated in the ServiceNow documentation. No out of the box record has been read from an instance yet.

Property name	`mid.log.command_audit.enable`
Type	Not stated
Application	Not stated
Default value	Not stated
Description	Not stated

Sources

Official references and nearby text excerpts where this property appears.

Brazil docs View supporting context

Context preview Snippet 1

... which they are associated. 267 Documentation Updates [ecc_agent_command_audit_log] table. Navigate to All > MID Server > Audit Logs > Command Audit Logs to see this table. • Remediation ◦(Old‎ Set mid.log.command_audit.enable to "true" in the ecc_agent_property table to turn on auditing for commands run by the MID server. See the following documentation for editng this mid server property: https://docs.servicenow.com/ csh?topicname=mid-audit- log.html&version=latest ...

Brazil docs View supporting context

Context preview Snippet 2

... Quebec, the command audit log only supports recording the commands run during discovery. Enable the command audit log The MID Server audit log is enabled with the MID Server property mid.log.command_audit.enable, which is set to false by default. Add the property in the MID Server Properties table [ecc_agent_property_list.do]. Once enabled, the MID Server command audit logs are accessed in the instance ...

More in `mid`

Other properties in the same namespace.

mid.install_server.base_uri This property sets the Base URI used by the mid server to download packages, allowing for customization of the mid.jdbc.datastream.max.record.size This property limits the size of records processed by the MID Server's JDBC data stream, with a default maximu mid.keystore.max_backups This property determines how many key store backups can be retained, with a default limit of three backups. mid.local.run_on_startup This property configures the local MID server to run automatically at system startup, facilitating continuous mid.log.level It configures the logging level of the MID Server, with options including debug, info, warn, and error, affect mid.max_down_days It defines the threshold in days for how long a MID Server can remain down before it is treated as inactive fo mid.mi.anomaly_detection.disable This property, when set to true, prevents the system from detecting and reporting anomalies in CI metrics. mid.nmap.npcap.version This property defines the specific version of Npcap used during the installation of Nmap, impacting how Nmap o

All 59 properties in mid →