Business Rules on [sysevent] table cannot be used - Syslog probeIssue <!-- div.margin { padding: 10px 40px 40px 30px; } table.tocTable { border: 1px solid; border-color: #e0e0e0; background-color: #fff; } .title { color: #d1232b; font-weight: normal; font-size: 28px; } h1 { color: #d1232b; font-weight: normal; font-size: 21px; margin-bottom: 5px; border-bottom-width: 2px; border-bottom-style: solid; border-bottom-color: #cccccc; } h2 { color: #646464; font-weight: bold; font-size: 18px; } h3 { color: #000000; font-weight: bold; font-size: 16px; } h4 { color: #666666; font-weight: bold; font-size: 15px; } h5 { color: #000000; font-weight: bold; font-size: 13px; } h6 { color: #000000; font-weight: bold; font-size:14px; } ul, ol { margin-left: 0; list-style-position: outside; } --> Description The information on the documentation page on Syslog probe (see below) can be misleading as the example listed will not work. The code path that the login.failed event takes explicitly uses setWorkflow(false), so a business rule will not run. Documentation page: https://docs.servicenow.com/csh?topicname=r_SyslogProbe.html&version=latestExample described: "...The system administrator uses the login.failed event to trigger a business rule that invokes the Syslog Script Include each time a login fails." Workaround As a Business Rule may NOT fire for all events on [sysevent], make use of Script Actions. Additional Information The affected documentation page is now under review and should be updated soon to reflect actual behavior.