Admin users unable to view sys_audit

[James Michaels1]

We have an issue where some of our admin users can't access the sys_audit table. For these users it always times out. Other admin users with the same group and roles are able to view the table and it takes less than 20 seconds to pull up. All of the response delay is server side and switching CPUs doesn't matter. I assume this is a user preference issue but can't figure out which preference it would be.

[sergiu_panaite]

Hi James,

How are the users trying to access the table? Are they just using sys_audit.list or sys_audit_list.do?

If the table is under Table Rotations (extended) then above will trigger a UNION ALL between all sys_audit shards, which usually is an expensive query on database side.

Large queries like this will bring large resultsets back, so usually they will not be stored for long time in database buffer pool. First time when you do a query like this is usually slow (or times out if you have quota enabled), but then it gets cached in the buffer pool and becomes fast second time. After a while is flushed from the buffer pool and becomes slow again (MySQL uses LRU algorithm for InnoDB buffer pool).

What you could try is using a URL where you get the filter only for the table and then you can expand and apply filter conditions to return less data:

https://<yourinstance>.service-now.com/sys_audit_list.do?sysparm_filter_only=true

Hope this helps.

Regards,

Sergiu

[James Michaels1]

All users were using sys_audit.list. For some it pulls up the table in <20 seconds for the others it times out at five minutes. I tried accessing it with a filter limiting it to just today but still couldn't access the data.

[Chris M3 · Accepted solution]

I would imagine it is related to the users default sorting on the table.   Under user preferences, check for sys_audit.db.order & sys_audit.db.order.direction, and delete those properties.

[James Michaels1]

Looks like that fixed the problem. I wonder why that caused it though?