How long we can restore deleted records from sys_audit_table?

[nikhilsoni973]

Hi, So I have deleted records in sys_audit_table so my question is can we restored record which was deleted before last 7 days because I have find one blog where it is mentioned that we can only restored records which was deleted within 7 days and we can still restore the record after 7 days, but only references will be restored. what does mean by references will only restore. I am attaching that blog post. Please explain me about references will only be restored if these blog post is correct.

Thanks

[SatyakiBose]

Hello @nikhilsoni973 

The image that you have shared is not a valid or official ServiceNow site to refer to.

• Any data that is deleted is stored in the sys_audit_delete table for 28 days.
• If you wish to restore the data within 28 days, you can restore it from the instance itself.
• Now coming to the screenshot you shared, you have highlighted the part where it talks about cascaded deletion.
  1. so for example lets take user table & incident table.
  2. If you configure the user table cleanup with cascaded delete, then all the incidents assigned to the user will also be deleted.
  3. But after 7 days, if you wish to restore the data for the Users and Incidents, and if the user table is not audited, then you get all the incidents records back. But the assigned to field will only have a reference sys_id, but not an actual value.

Hope I was able to clear it for you.

You can also check this documentation here - https://docs.servicenow.com/en-US/bundle/utah-platform-administration/page/administer/field-administ...

[nikhilsoni973]

What do you meant by user table is not audited, if User table was audited then only it got tracked in sys_audit_delete table right? so after 7 days It will be audited only right?

[SatyakiBose]

Hello @nikhilsoni973 

In simple terms, if the table is audited, and if you delete something from the table, you will find the entry in sys_audit_delete table.

If the table is not audited and data is deleted from the table, then you will not find the record in sys_audit_delete table.

However, am not sure of the 7 days feature.

As per the official documents, ServiceNow stores deleted data for 28 days.

Please do not refer to unofficial or unauthenticated sites for such details.