Track who updates or deletes attachments from ANY table

[Rory6]

So our developer went on medical well that puts me in a bind as I have no background in actual coding.  I review a lot of information from the community on attachments but no "step x step".  I wouldn't expect it as everyone seems to be a developer BUT, any chance someone can instruct me through the steps to turn on attachment tracking so, I know who updated/deleted any attachment for any table, or if I need to have a specific table cmdb_ci_appl.

[Mike Allen]

Yes.  Unfortunately, the event does not give a lot of info, like, what table was the attachment on?, or what was the name of the attachment?  But, it is at least a start.

[Rory6]

I guess it's better thank a poke in the eye.  I can locate the table in which the attachment was performed but not the specific record.  Thanks Mike

[Sumanth16]

Hi Rory,

You can enable audit for sys_attachment table.Then you can track the who updated(or) deleted attachment.

(or)

If you would like to track who deleted an attachment you could write an after delete business rule on the sys_attachment table.   The business rule could add a work note or additional comment to the incident to inform end users of who deleted the attachment.

var gr = new GlideRecord(current.table_name);

gr.get(current.table_sys_id);

gr.work_notes='Deleted attachment ' + current.file_name;

gr.update();

Thanks,

Sumanth

[Rory6]

Thank you Nani but I literally do not understand the step x step process on how to apply this great idea.

thank you

[Sumanth16 · Accepted solution]

Hi,

Please refer below links:

1) https://docs.servicenow.com/bundle/london-platform-administration/page/administer/security/task/t_En...

2) https://docs.servicenow.com/bundle/london-platform-administration/page/administer/system-logs/task/t...

3) https://hi.service-now.com/kb_view.do?sysparm_article=KB0678833

Thanks,

Sumanth