System updated priority 5+ months after closure

[PLakin1]

I'm attempting to find what if any information from our instance on why System updated the priority of at least two tickets within about 2 hours of each other on the same day, over 5 months after the ticket was closed. System made the update and I cannot think of a single system we've altered or created that should have caused it to happen.

The tickets I've found with this issue, so far, are Incidents. There are no obvious similarities between the tickets; none of them were from a catalog item, they are to different assignment groups, for different impacts. Only a handful of tickets out of hundreds appear to have been affected. There were two sets of audit updates in the history that happened simultaneously.

Any help is appreciated.

Thanks,

Paul

[AnveshKumar M]

Hi @PLakin1

Have you checked the system log, transactions and node logs?

Also chek script execution history.

[Bert_c1]

What is a "ticket"? post the table. Look at the audit history of the record in question.

[PLakin1]

I've added more details above. Looking at the logs, nothing stands out. There were several information notifications that occurred during that timestamp and one error. The information notifications are "for asynchronous providers" and the error is for a Universal Request SLA (don't ask, Universal Request has been a nightmare).

[Bert_c1 · Accepted solution]

Audit history doesn't show the transaction. However, Servicenow Support can find the source if you create a Support Case. Ideally you have examples within 4 days as database logs aren't kept longer.