Data stored in sys_audit_delete table

[nguyen duy]

Hi Team,

Currently, I want to get deleted records from the sys_audit_delete table and I have 3 questions as follows:
   - How long does the sys_audit_delete table store deleted records?
   - Can I get deleted records of 6 months, 1 year, or 2 years ago? And if possible, how?
Many thanks for all your contributions to my question.
Hoping to get an answer soon.

Thanks,

Duy Nguyen.

[Dipu Joy]

It all depends on how you delete the data.

1.You have Rollback context which by default store your deleted data for 15 days(OOB property).

sys_rollback_context is the table. Roll back option can get you the data intact with references for 15days.

2. sys_audit_delete. Data from all tables are not tracked on this table. This table do not have an expiry.

But like Jaspal told, it will be hard to get the references if you need to restore as time goes by.

Realistically these are the timelines

1. You can get all your data with references intact for 15 days if the deletion is stored in sys_rollback_context.

2. 4 days if ServiceNow does it from BINLOG and there are no other ways to recover the data ( no data in sys_rollback_context) to a specific minute, ( if data was deleted at 10:40; we can restore the instance to a TEMP instance to 10:39 to get the up-to-date data)

3. Just Data without references with some data loss for 28 days as we use daily/Weekly backup to restore the backup to another instance and recover it from there.

4. At times an OLD clone to a SUBPROD will be our saviour if it can be retrieved from SUBPROD as the data was cloned over.

This KB will give an idea about how we can restore your data and also the backup policies

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0992741