- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎05-30-2017 01:28 AM
Hi All,
Records deleted from a table say Incident table is stored in Deleted Record. However, what if the record is further deleted from Deleted Records(sys_audit_delete_) table. Is there a way to audit it.
Requirement is to find an Incident number that triggered SLA breach notifications to a set of users in a group but when I look for the incident number in my instance, it is nowhere to be found. I checked in incident archive(Incident was not there). Also, in task_sla table and could see that the incident is recorded in task_sla table as being breached. But when I try to reopen the incident, it is not found, I suspect the incident number has been deleted from the system.
below is the screenshot I get while trying to open the incident from the task_sla table
Thanks in advance
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎05-30-2017 01:36 AM
if you go into the sys_audit table, you can see who deleted the incident like this:
Btw, if you don't know who deleted stuff in production, I would recommend looking over the people having access right to delete. Seems to be to many of them.
//Göran
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎05-30-2017 01:36 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎05-30-2017 03:44 AM
Hi Goran,
Thanks for the assistance. However, the sys_audit table in my production instance is so big that it doesn't open at all, it keeps refreshing if try opening on it. Not sure how can I query on this table.
I would have applied filter, but for then the records in sys_audit table doest appear at all. Is there a way that I can check on this table
Note: sys_audit table in my sub-prod instance do open though it takes a bit longer to open
Thanks in advance

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎06-25-2019 12:37 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎06-26-2019 07:16 AM
Hi Annay,
That is true. that is when the record was deleted. In a baseline installation, audit isn't turned on for recording changed on what is visible on a form.
//Göran
Feel free to connect:
LinkedIn
Subscribe to my YouTube Channel
or look at my Book: The Witch Doctor’s Guide To ServiceNow