How to find out which scheduled job created/modified a specific record?

[vw1]

We have a SCCM Scheduled jobs that runs weekly, and we had to find out which job was causing the issue. The issue is that the Configuration Items / Servers were not edited properly, and new servers were created when there is an existing server with same Serial number.

Is there anyway that we could find the job log, and find which job created the CI with the CI's serial number / sys_id?

Thank you.

[Goran WitchDoc]

Hi,

Not sure how your jobs are set up and if they run at the same time. If they don't, then you might be able to match when the CIs were updated with when the jobs were running. If not, I at least don't know if any way of seeing which "script" updated a specific item. Then it's more down to troubleshooting and going through the code or on a sub-prod test each job one by one.

//Göran
Feel free to connect:
LinkedIn
Subscribe to my YouTube Channel
or look at my Book: The Witch Doctor's Guide To ServiceNow

[Radim Tichy · Accepted solution]

Hi VW,

my suggestion is to identify sys_id of wrongly created CI, try to find this CI sys_id in application log file.

If you do not have a number of application nodes and you most likely know quite well -at least- roughly the scheduled job has been executed it might e the starting point.

Once you find sys_id of this affected CI inside the application log, it should not be any issue to track back the starting point and the name of the job.

There could be an issue when you update your existing CI it does not match with any really existing but rather inserts new one.

It might be time consuming investigation but doable.

Kind regards

Radim