MID Server goes Down after 5-10 minutes, and ECC Queue not processed - query_range ACLIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } After installing a MID Server and/or starting it, the record appears in the instance, but within 5 to 10 minutes it gets marked as Down. Symptoms<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The MID Server record is created, proving the MID Server can connect and is authenticating.After first startup, or after a restart of the service, the MID Server record is set as Up.Within 5 to 10 minutes, it gets set as Down.The latest Topic=Heartbeat Output will be stuck in State=Ready (the older ones are automatically marked as Processed by the instance, even though they haven't actually been)The Agent log of the MID Server does NOT show any errors or warnings for the ECCQueueMonitor thread.Once the MID Server has started up, synched files, and settled down, the only logging is LogStatusMonitor thread every minute, and StatusMonitor+ECCSender every 10 minutes.The ECC Queue may show Inputs created by the mid server for topic=queue.stats, name=MID Server XMLStats every 10 minutes, even while being reported as Down Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Since May 2025. Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The MID Server login user fails the query_range ACL for the ECC Queue table. The instance Appnode localhost logs will show a successful status 200 /ecc_queue.do?SOAP transaction, showing the MID Server is looking for jobs in the ecc_queue: API_INT-thread-.. ... txid=... LocalhostTransactionLogger *** Start #... /ecc_queue.do, type: soap, user: <mid server user>API_INT-thread-.. ... txid=... tx_pattern_hash=-1896420824 LocalhostTransactionLogger *** End #.../ecc_queue.do, user: <mid server user>, render_size: 324, total time: 0:00:00.015, processing time: 0:00:00.015, CPU time: 0:00:00.000, SQL time: 0:00:00.002 (count: 7), Total memory allocated: 1.85MB, source: 86.47.216.153, type: soap, origin scope: global , method:getRecords, api_name:SOAP APIs, resource:ecc_queue.do, user_id:ee112bc9873d3e10ab9c2fce8bbb352c, response_status:200 However, appnode logs will also show this query_range warning, meaning the MID Server cannot see the ECC Queue records it is looking for: SOAPProcessorThread... ... txid=... QueryACLUtil WARNING *** WARNING *** Part of the query on ecc_queue has been ignored because of insufficient access for 'query_range' operation on ecc_queue.sys_created_on Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } MID Server users have mid_server role, which inherits the soap_ecc role. The ecc_queue table will already have ACLs for create/read/write/delete operations for the soap_ecc role, and so that is the role to use for these query_range ACLs too. Add a record level ACL (ecc_queue), and field level ACL (ecc_queue.*), for the soap_ecc role. You will have to either modify existing ACLs, or add new ones, to give the soap_ecc role access. Using Access Analyzer -> Analyze Permissions, for the mid server user, and ecc_queue table, will confirm the query_range ACLs fail. The following is from a working instance, showing query_range Passes. The others that fail are expected to fail, as mid_server role doesn't need to do those operations: Clicking on 'query_range' will list which ACLs you have. All relevant ACLs would be listed using this URL: https://<instance name>.service-now.com/sys_security_acl_list.do?sysparm_query=name%3Decc_queue%5EORnameSTARTSWITHecc_queue.%5Eoperation%3De66cf897b7300210240b06dd1e11a9fd You might see some records created by '@@snc_write_audit@@', which were added when servicenow enabled query_range ACLs in 2025. There may also be additional or custom ones listed. It is possible ACLs were added by servicenow, but Inactive, which could be activated. Or new ACLs would need adding. If a 'Deny If' ACL is present, that would overrule any 'Allow If' ones. The conditions of the 'Deny If' ACL, which is likely to be custom, would need correcting. Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } KB2046494 May 2025 Maintenance InformationKB2130442 Troubleshooting query_range ACLs