How sys_audit table is filled ? (where are the rules that created entries in the table?)

[vanessaheux]

Hello

I know that each time I modify an incident or a change request, all modifications (of status or anyone) are stored in sys_audit table and in another custom audit table.
I would like to see the place where the entries are created in these tables.
When I check "configure/all" in the table itself, I can't see a rule that shows how this table is filled.
When I go on display of an incident or a change request and I check "configure/all" I see many business rules or clients scripts, etc... but none of them are done on sys_audit table or my specific historical table.

How can I find how these tables are filled ?

As you don't know my custom table, I think that if you can tell me how sys_audit table is filled (where is the rule to add an item in this table), I'll have the methodology to search how my custom table is filled.

Regards

Vanessa Heux

[scott barnard1]

Hi Vanessa

In the documentation referenced above it shows you what triggers the audit records.

If your custom table doesn't have the audit condition set then audit doesn't happen

Set your table to be auditied as per the doc

https://docs.servicenow.com/bundle/helsinki-platform-administration/page/administer/security/task/t_EnableAuditingForATable.html

Note that on very large tables or tables with high traffic auditing may impact performance.

regards

[vanessaheux]

No what I mean is that I have a custom table which does nearly the same thing as sys_audit table.

This means that this custom table  seems to save any change in the incident or change request management, exactly like sys_audit does but with other field (for example sys_audit has the document key whereas my custom table has number of incident which is better to use).

But my real question where is defined the code in the instance where the new entries in the table will be created.

Regards

Vanessa Heux

[Vipin Murugesan]

Hello Vanessa,

Have you found a solution for this ?

Have you seen the place where the code is defined to capture the data ?