Edit activity log additional comments

rlehmann · ‎08-08-2014

We are currently running Dublin and I've been asked by our security team to remove a password which was accidentally added as an additional comment to a requested item.

I tried viewing the history list on the ticket and selecting the entry with the password to delete it, but delete doesn't appear to be an option.

Ideally, I would like to just edit the entry to only remove the password and not delete the entire additional comment.

I've been searching the forums and the wiki to see the best way to edit a previously entered additional comment in a requested item, but have not found anything outlining the steps to take, short of the process provided by Mark (http://www.servicenowguru.com/system-definition/remove-activity-log-journal-entries/).

I have to follow the change management process in my company, which would take at least a week to have all of that approved for implementation.

Since it is only the one ticket to update and they want it done quickly, I would much prefer to edit the entry manually.

Does anyone have details on the steps required to do so?

Thanks in advance for any and all suggestions.

Cheers

Ron L.

tmanino · ‎08-09-2014

The text still shows in the activity history of the record because it is actually displaying history entries constructed from the sys_audit table. You need to remove the text from sys_journal_field first, where the current entry is actually kept. Then remove it from sys_audit, and finally remove the sys_history_set record. When the task record is displayed again, the history records will be rebuilt with the updated journal entries.

The procedure below will work. Practice on another instance before you do this in production, and exercise caution. You will need to use an admin account.

SEI is "sensitive electronic information," i.e. something you don't want exposed for everyone to see.

1 Obtain the sys_id of the record

Open the record containing the insecure SEI.
Right-click in the record header, and choose Copy sys_id.

2 Remove from sys_journal_field

Use this URI to query the journal entries: https://your-instance.service-now.com/sys_journal_field_list.do?sysparm_query=element_id=sys_id
- Replace sys_id with the sys_id of the record.
- Replace your-instance with your instance name.

If there are a lot of records, you may want to refine the query, adding a "Value contains SEI" condition. Replace SEI with the text you seek.

Edit the Value field of each record to remove the SEI.

3 Remove from sys_audit

Use this URI to query the audit entries: https://your-instance.service-now.com/sys_audit_list.do?sysparm_query=documentkey=sys_id
- Replace sys_id with the sys_id of the record.
- Replace your-instance with your instance name.

It may be helpful to add conditions to the query for "Old value contains SEI" OR "New value contains SEI".

Edit the text of the Old value and New value fields, removing the SEI.

4 Delete the sys_history_set record

Query the sys_history_set table using this URI: https://your-instance.service-now.com/sys_history_set_list.do?sysparm_query=id=sys_id
- Replace sys_id with the sys_id of the record.
- Replace your-instance with your instance name.
Delete the record that is returned.

View solution in original post

williamsun · ‎08-08-2014

Check that first comment right after the sncguru page.

Right click on the record top and go to History --> List.

Find the comment you want to remove and then delete it. You might even be able to modify it.

As they state here, this changes the public view on the record's activity, but not the internal audit log and journal log.

rlehmann · ‎08-08-2014

Hi William

Thanks for the response, but as mentioned in my post, "I tried viewing the history list on the ticket and selecting the entry with the password to delete it, but delete doesn't appear to be an option." When I select the action choices, Delete is grayed out as a choice and the only choice available is New. I also tried following the procedure further down in the comments of that post, mentioning a multi-step process with the sys_id and the audit_sysid, but I am unable to load the mentioned URLs with the sys_id & audit_sysid numbers I retrieved, as no records are returned for each.

I didn't imagine it would be this difficult to edit a simple additional comment entry.

Thanks again

Ron

Subhajit1 · ‎08-09-2014

Exercise Caution while doing this - Probably do this Off-Business Hours.

Get the sys_id of the record of whose Comments you need to edit.

Got to App Nav->type in sys_journal_field.list.

Look for the sys_id in the sys_id column in the table. You will find corresponding Updates on journal type entries for the record.

Update the required one.

Thanks,

Subhajit

rlehmann · ‎08-09-2014

Hi Subhajit

Thanks for the response.

I can definitely see the comments that need to be edited and have made my edits to them and saved them.

The problem is that when I go back to the initial requested item, the edited additional comments do not appear and I still see the original comments. I've checked this as an admin, ITIL user and ESS user.

Appreciate your efforts.

Thanks

Ron