How to find out which script is making changes to a record?

[Suggy]

For configuration item records,  there are some updated happening to fields like asset tag, model ID etc.

When I checked the history, its in the name of SYSTEM ADMINISTRATOR.

Need to find out how which script is making that change.

We checked Business rules, scheduled jobs etc but couldnt get any clue.

Is there a way to know which script is making that change?

[Suggy]

Hi @Mark Manders Thanks for the hint but the problem with 'context map' field is, only if gs.log is used in the script, it gets logged in system logs. If a BR does not contain gs.log, then no entries will be logged in system logs right, so context map will not help in such cases.

[Sai Chaithanya]

Do the following. 

Since the updated by is showing as System Admin, check if any external systems have admin id and password for accessing the APIs.

Apart from that check Scheduled Jobs, Discovery schedules where Run as is mentioned as System Administrator

[Suggy]

@Sai Chaithanya  checked all of them but found no clue.. but again its a manual search and there could be chances of missing things, hence posted this question here to see if there any best way to catch the culprit 🙂