Audit Logs for checking who is deleting Templates

[michelle kirk]

Hi

Within our Incident Platform, we have created Templates for the analysts to use, but someone keeps deleting them.

Our platform provider is stating that they cannot see the Audit Logs so therefore unable to advise, 

They have said that if we would like this functionality. we can have it, but it would be a cost involved. 

Is this correct that all Audit Log functionality is not standard OOB ?

[Mark Roethof · Accepted solution]

Hi there,

Sys Audit is out-of-the-box. Its more not everything is out-of-the-box Audited. Same for deletions, not all deletions are Audited. It is possible though. Do be careful, don't just Audit everything you can, because it can have consequences (performance, manageability, database footprint growth).

[Mark Roethof · Accepted solution]

If you are talking about the sys_template records, deletions on those out-of-the-box are written to the Sys Audit table. If that's not the case in your instance:

- Perhaps someone disabled that for sys_template?

- Someone is deleting the deletions 😅

- The deletions might occur scripted, avoiding writing a.o. Sys Audit

[Mark Roethof · Accepted solution]

Hi there,

Sys Audit is out-of-the-box. Its more not everything is out-of-the-box Audited. Same for deletions, not all deletions are Audited. It is possible though. Do be careful, don't just Audit everything you can, because it can have consequences (performance, manageability, database footprint growth).

[Mark Roethof · Accepted solution]

If you are talking about the sys_template records, deletions on those out-of-the-box are written to the Sys Audit table. If that's not the case in your instance:

- Perhaps someone disabled that for sys_template?

- Someone is deleting the deletions 😅

- The deletions might occur scripted, avoiding writing a.o. Sys Audit

[Mark Manders · Accepted solution]

Templates are stored in the sys_template table. You really should get rid of this provider. I guess some companies will try to get money for everything they do, but this is ridiculous.

Go to the dictionary collection record of the sys_template table (https://yourinstance.service-now.com/now/nav/ui/classic/params/target/sys_dictionary.do%3Fsys_id%3Dd...) and tick the 'audit' box. That's it.

Next time a template is deleted, you can go to the 'sys_audit' table, select 'table name' is sys_template and 'field name' is DELETED. It will give you the 'who did it' in the 'user' column. Your partner should be ashamed for asking money to just tick a box.