How to audit to see who deleted attachments from Incidents?

Viskop_KP
Kilo Guru

‎04-08-2019 07:02 PM

Hi,

There are a lot of information (and steps) on how to audit tables, records, attachments, etc, but what I need to know is how to turn audit on to see which user has deleted an attachment from, for example, an Incident ticket.

I have tested this by attaching a simple Excel file to an incident ticket. When searching in the 'Attachment" table, I find the record of the attachment, and I can see that I have attached it. Yet, after deleting the attachment from the incident record, likewise the record is also deleted from the 'Attachment" table, and I am unable to see who has deleted the attachment (yes, in this case it was myself, but you all know what I mean :P). And the 'Audit Deleted Records' table is not helpful at all.

 

Any help will be greatly appreciated. And we're on the London release. 🙂

 

Thanks.

Labels:
0 Helpfuls
  • 3,086 Views
5 REPLIES 5

Harish KM
Kilo Patron
Kilo Patron

‎04-08-2019 07:14 PM

You can Audit Attachment table?

https://docs.servicenow.com/bundle/geneva-servicenow-platform/page/administer/security/task/t_EnableAuditingForATable.html

Regards
Harish
0 Helpfuls

Viskop_KP
Kilo Guru
In response to Harish KM

‎04-08-2019 07:56 PM

Thank you sir. I will give that a go tomorrow and hopefully this will help. 🙂

 

I appreciate your reply.

0 Helpfuls

Viskop_KP
Kilo Guru
In response to Viskop_KP

‎04-08-2019 08:42 PM

Ok, I have managed to test this and it was not successful. Here is what I did:

 

1) As system admin I went to 'System Definition > Dictionary' and searched for "sys_attachment" table, and a large number of records were returned.

2) Where possible, I turned all records that had 'Audit' = 'False', to 'True' (I could not make all set to 'True', and pls keep in mind this testing I am doing in my personal developer instance)

3) Next I impersonated an end user and went to 'Incidents > Assigned to me'

4) I opened one of the incidents, attached a simple Excel doc (and yes, I did check as sysadmin that the new record appeared in the 'Attachments' table).

5) As the end user I then clicked on "Manage Attachments"...and I remove the attachment.

6) finally, as sysadmin, I went back to the 'Attachments' table...and no record, that an end user deleted an attachment, was added. But the record that was created when the attachment was added, was removed from the 'Attachments' table.

So basically no record of "who" deleted the attachment.

Thanks though for your willingness to help. I will keep an eye out for other suggestions. 🙂

0 Helpfuls