Audit the sys_user table, why not?

[Eileen Hessmill]

The sys_user table is not audited by default. Are there arguments against turning audit on? Is performance impacted? Is it good practice to set the audit on for the entire table, or individual fields? 

My user would like the sys_user table audited for add/modify/delete, but would like to know the impact beforehand. 

Thanks!

[ARG645 · Accepted solution]

Hi 

By default, the system does not audit records from system tables. To audit a system table, add it to the list of tables in the glide.ui.audit_deleted_tables property list.

Jump to Auditing System Tables Section in the below Link

Auditing system tables

Caution: Auditing certain system tables that receive a large amount of traffic, such as Workflow Contexts [wf_context], can impact performance and is not recommended.

Audit the fields on sys_user table that are not subjected to frequent changes. This is the safest way with out impacts.

For example you don't want to Audit  last login time as it changes every time someone logs in.

That way you audit fields you care about, but not ones you don't care to or are automated updates etc. plus Auditing the fields that are changed frequently will clog up your history and make it hard to see the important items.

[ARG645]

Please Close this thread if your question is answered. 

[Eileen Hessmill]

Thanks Aman.