How to find source of system updating a record

[Ryan M]

We are trying to find the source of some records being deactivated.  The system is changing active to false on a nightly basis.  This is happening on certain records (not all active records) in the sn_imt_diagnosis_request table.  It happens at the same time the night it does happen.  There are no scheduled jobs at this time for this table.  There is a business rule that deactivates records but the conditions do not match and the rule also updates the comments (which is not showing for these).  

Is there a way to figure out what process/script is making this update?

[sachin_namjoshi]

Use code search in studio to find out any code which is updating these records.

https://community.servicenow.com/community?id=community_blog&sys_id=136caea1dbd0dbc01dcaf3231f96198a

Regards,

Sachin

[Michael Ritchie]

I don't know much about the Emergency Exposure Management but according to the Docs, there is a scheduled job that runs called Execute employee diagnostic events which appears to run quite often.  It queries for Diagnostic Events [sn_imt_diagnosis_diagnostics_event] records and under certain conditions its parent Diagnostic Request [sn_imt_diagnosis_diagnostic_request] will be updated.  There is also a business rule on Diagnostic Events that updates its parent Request too.

The scheduled job would be run as "system" so some sort of condition must be met at 1 AM each day to set the status of your Event records accordingly which is then closing out the Request.

[Ryan M · Accepted solution]

All good information in the replies here, particularly the code search tool, that will be helpful in the future.  In the end we found the source as a System Scheduler -> Scheduled Jobs not realizing that you could have an entry there without having one in System Definition -> Scheduled Jobs.