What deletions are captured in the sys_audit_delete table?

[jabra]

I am trying to nail down which deleted records are written to the sys_audit_delete table to take advantage of reading that table in order to delete records from tables in a data warehouse.

I saw a post in the community that said "Remember, only those tables or their parents with the audit flag set to true will audit deleted records."  That is what I believed but when I deleted records from a table (cmdb_ci or task_ci) where neither that table nor the parent table has an audit flag set to true, the deleted records showed up in the sys_audit_delete table anyway.

Are all deleted records written to the sys_audit_delete table?

[The Machine]

Hello, this might shed a little more light on what records are tracked.

https://docs.servicenow.com/bundle/orlando-platform-administration/page/administer/table-administrat...

[jabra]

I had read this article and while it tells me how to turn audit on for a SYS_ table, it does not seem to indicate which deleted records will be captured by the sys_audit_delete table.

[The Machine · Accepted solution]

But it does.  🙂 

It says tables that contain no_audit_delete=true are not tracked.  So you would do look at dictionary entries of type collection that does not contain no_audit_delete=true.  The query below will list the tables that are tracked.

https://instance.service-now.com/sys_dictionary_list.do?sysparm_query=internal_type%3Dcollection%5Ea...

[jabra]

Thanks.  I was missing that the value was in the attribute field.