How to find which script caused the audit

[BoHyun Jung]

Server IP was automatically changed at 4am in Data source record. Is there a way to see what script changed it? (ex, business rule, scheduled job....)

[Mark Manders]

Can you find the update in the system log? If you add the 'context_map' field to the form of your syslog entries, you will have a more detailed overview of where something is coming from:

[Mark Manders]

I didn't try it yet, but maybe you can even search on the sys_id of your record in the as 'context_map CONTAINS.....'

[MackI]

HI @BoHyun Jung 

Try to check this area in the servicenow node 

However if your organization make some custom script then either you can check the background script during that time or check wth your development team

Accessing Node Logs
1. Log into your ServiceNow Instance: Use your administrator or developer credentials.
2. Navigate to "System Logs": You can find it in the left-hand navigation menu under the "System Diagnostics" section.
3. Select "Utilities": In the "System Logs" menu, click on "Utilities."
4. Click "Node Log File Download": This will take you to the interface where you can view and download node logs.
Viewing and Analyzing Node Logs
1. List of Logs: You'll see a list of available node logs in the "Node Log File Download" module. These logs are typically named with a timestamp and the node identifier (e.g., "2024-07-11_09-15_node001.log").
2. Right-Click to Open or Download: Right-click on a log file name to open it directly in the browser or download it to your computer.
3. Search for Relevant Information: Use your browser's search function (usually Ctrl+F or Cmd+F) to search for keywords related to the IP address change, the data source record, or any specific error messages you may have encountered.
4. Check Timestamps: Pay close attention to the timestamps in the logs to identify events that occurred around the time of the IP address change (4 AM in your case).
Additional Tips:
* Filter Logs: You can filter the list of logs by node, date, or other criteria to narrow down your search.

If you like this opinion. Please kindly mark this your best answer and help to contribute more to this community