Protected Tables Plugin will block DiscoverySensorJob logging, and cause ProtectedTableAccessHandler warnings about syslog inserts insteadDescriptionWhen the Protected Tables Plugin is active, which is recommended, the source= DiscoverySensorJob GlideRecord inserts made directly to the syslog table by Discovery's 'DiscoverySensorJob' script include are blocked, and flood the syslog table with logs from source=ProtectedTableAccessHandler instead. This doesn't break Horizontal Discovery, or increase the total number of records in syslog, however these Discovery log messages won't be available for debugging or checking the progress of Discovery. This does add many false positive warnings to the Protected Table log protection feature, that have to be filtered out to see the real warnings.Steps to Reproduce On a Yokohama Patch 6, and Zurich, or later instance (since the fix for PRB1899269):1. Follow the recommendation for Instance Hardening to enable the Protected Table Plugin for Log protection.https://www.servicenow.com/docs/csh?topicname=accept-log-protection.html&version=latest2. Run a Discovery Schedule.3. Check the syslog table for source=ProtectedTableAccessHandler records Actual behaviour The default setting for the Protected Table Plugin for syslog/insert is "Block and Log the attempt", so instead of the expected "Begin processing.." and "End processing ..." logs from source DiscoverySensorJob logs, you will see warning level records from ProtectedTableAccessHandler. e.g. Source: ProtectedTableAccessHandlerMessage: The operation was blocked for the configured table: Details{Table Name=syslog, Operation=create, Modified fields=[source, message], User=midserver, Source=78dfb2dd536002001f175f43911c087d, Source Table=sys_script_include, Operation blocked=true, Operation tracked=true}Source Record: Script Include: DiscoverySensorJob If the setting is changed to "Only Block the attempt" to get rid of the millions of system log message this causes, then real log tampering attempts would also get hidden, defeating the point of the feature, in addition to Discovery logging being hidden, so that is not a sensible workaround. Expected behaviour If logging APIs were used in this script include, such as gs.log(), these warnings would not occur.WorkaroundThis problem is currently under review and targeted to be fixed in a future release. Subscribe to this Known Error article to receive notifications when more information will be available. Attached is an Update Set which makes the following changes to Discovery's 'DiscoverySensorJob' script include.https://<instance name>.service-now.com/sys_script_include.do?sys_id=78dfb2dd536002001f175f43911c087d PRB1930200 workaround for Yokohama.sys_remote_update_set_f95cc653872722107f737736cebb35e8.xmlThis workaround is based on the Yokohama Patch 8 version of the script include.It is for Yokohama Patch 6, 7 and 8 instances. Check for other more recent out of box changes to the script include if using on more recent Yokohama patches. For a Zurich instance, implement the workaround manually, as the script is different to start with. Note: This update set should be backed out, or the customisation reverted, once the instance is upgraded to the fixed version. From: ... logMsg = new GlideRecord('syslog'); // Note that this exact string is used in getTxInfo() (above). // If you change this message then you need to change that function too. logMsg.message = 'Begin processing ' + DiscoverySensorJob.buildJobNameFromEcc(current); logMsg.source = 'DiscoverySensorJob'; logMsg.insert(); ... logMsg = new GlideRecord('syslog'); logMsg.source = 'DiscoverySensorJob'; // Note that this exact string is used in getTxInfo() (above). // If you change this message then you need to change that function too. logMsg.message = 'End processing ' + DiscoverySensorJob.buildJobNameFromEcc(current); logMsg.insert(); ... To: ... // Temporary workaround for PRB1930200 Protected Tables Plugin will block DiscoverySensorJob logging, and cause ProtectedTableAccessHandler warnings about syslog inserts instead gs.log('Begin processing ' + DiscoverySensorJob.buildJobNameFromEcc(current),'DiscoverySensorJob'); // logMsg = new GlideRecord('syslog'); // Note that this exact string is used in getTxInfo() (above). // If you change this message then you need to change that function too. // logMsg.message = 'Begin processing ' + DiscoverySensorJob.buildJobNameFromEcc(current); // logMsg.source = 'DiscoverySensorJob'; // logMsg.insert(); ... // Temporary workaround for PRB1930200 Protected Tables Plugin will block DiscoverySensorJob logging, and cause ProtectedTableAccessHandler warnings about syslog inserts instead gs.log('End processing ' + DiscoverySensorJob.buildJobNameFromEcc(current),'DiscoverySensorJob'); // logMsg = new GlideRecord('syslog'); // logMsg.source = 'DiscoverySensorJob'; // Note that this exact string is used in getTxInfo() (above). // If you change this message then you need to change that function too. // logMsg.message = 'End processing ' + DiscoverySensorJob.buildJobNameFromEcc(current); // logMsg.insert();...Related Problem: PRB1930200