Audit sys_attachment table

[jk061]

Hi, is there way to turn-on audit on the sys_attachment table in particular track new attachments. I have enabled audit on this table as well as change system properties as mentioned in the following link, but in vain. However, I do get delete log in the audit table if an attachment is deleted.

Turning on Auditing (History) for a Table - ServiceNow Wiki

Appreciate any Help.

Thanks.

[bernyalvarado]

Hi Juzer

Sure! You can grab that information from the event log.

When an attachment is uploaded and associated to a record you will see an event named: attachment.uploaded

In the Parm1 it would contain the table where it was uploaded. For instance incident

And in the Parm2 you will have the sys_id of the record where it was uploaded

Thanks,

Berny

[bernyalvarado]

Hi hope it's helpful

Thanks,

Berny

[jk061]

Hi Berny.

I am still a newbie and not familiar with event log. Can you please point me to any documentation on how event log works. Is it similar to audit table i.e. needs to be turned-on for tables of interest. Much appreciated.

Thanks,

Juzer.

[bernyalvarado]

Hi Juzer, just type in your navigation window event and you pick the one under System Logs >> Events.

Over there, filter where the name matches attachment.uploaded

If you don't see any event with that name, just go and attach a document to a record and then come back to the Event log and try again. Over there you will see what I explained before.

Thanks,

Berny

[jk061]

Hi Berny,

Thanks for your help. Hopefully last question. I need to make a REST API call to download the attachment. Is there a straight forward way to do it. I searched the servicenow community looking for an answer and happen to come across conversation that mentioned of using a call with following syntax:

instance/sys_attachment.do?table_sys_id=45a0f20f6fc40200cf3a89f1be3ee422&table_name=u_customers&sys_id=b9a0be036f48020021ec5e02be3ee4c4&sysparm_view=

Thanks,

Juzer.