What is the best way to audit who has viewed a record in a table?

[miriamberge]

We want to track (on a fairly large table) who has viewed the details of a record.  Essentially this would be an audit for sensitive data stored in the system.  We would not want to restrict the user's access to the table but we would want to be able to provide details if someone came to us and asked who looked at the record.  Ideas? 

[SanjivMeher]

I would create a table like we have for knowledge articles, which can store who viewed and which record is viewed.

A record can be created on this new table using an onLoad script. Because onLoad script will run everytime a user views the record.

[sachin_namjoshi]

This is maintained in below table whenever any user views records.

You can open use below table to audit who viewed records.

sys_ui_navigator_history

Regards,

Sachin

[Mwatkins]

Hm... I definitely would not recommend building a solution on the sys_ui_navigator_history table.

Currently sys_ui_navigator_history does keep track of all user navigation but that is definitely not an audit of all users who have viewed a given record. It stores the URL that was viewed for some transaction types but not all.

Secondly, while today the sys_ui_navigator_history table is never cleaned, there is no guarantee it will always be that way and, in fact, I am aware of discussions that may result in eventually adding a table cleaner to this table; which is probably a good idea since it can grow quite large and was only ever designed to contain transient data for assisting in navigation tools.

[sachin_namjoshi]

Well, there is no OOB solution to report on which user viewed records .

You can always filter out data based on particular table using URL from navigation history. 

Table rotation for sys_ui_navigator_history is news for me since this is no where documented.

Another option will be to configure a Display business rule that runs when a record is displayed to achieve this. Create a new journal field for tracking 'views' and then add notes into that field in Display business rule. .   This will update the record each time the form is viewed and show in the audit logs for that record.

function onDisplay(current, g_scratchpad) {


  //This function will be automatically called when this rule is processed.


  current.work_notes = 'Record viewed by ' + gs.getUser.name;


  current.update();


}

It's NOT a good idea to create "Global" business rule just for this reporting requirement.

OR

There's an out of the box event called as user.view, which generate when any user views records in table. You could build custom table ( which customers need to pay for as per new licensing model which gets populated based on this event.)

Whats your solution for this requirement?

Regards,

Sachin