Auditing missing from sys_user table

[daov]

I was planning to enable auditing on sys_user.name and sys_user.email, but the Audit checkbox doesn’t appear in our ServiceNow instances. I’ve already elevated to security_admin and confirmed the field isn’t hidden—the Audit field is present on the form, just not selectable.

I also wondered whether this might be because sys_user is part of a collection or inherits auditing from another table, but I haven’t been able to find anything indicating that.

Has anyone run into this before or have suggestions on where else I should check?

[Chaitanya ILCR · Accepted solution]

Hi @daov ,

do you want to enable audit only on name and email fields?

if yes you can refer this

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0685670

for all columns go to the dictionary and filter the collection record of your target table and enable the audit

https://www.servicenow.com/docs/r/platform-security/t_EnableAuditingForATable.html

Please mark my answer as helpful/correct if it resolves your query.

Regards,
Chaitanya

[daov]

Thank you.  That was very helpful.  I was able to find that sys_user collection table and the reason why i don't see the audit button in the form is because the whole sys_user collection was enabled for auditing.