How to find out who has deleted a user's role ?

Sai176
Kilo Contributor

Hi,

A user belongs to some groups which have ITIL roles(inherited=true) and was also given ITIL role separately(ITIL role that is inherited=false).The issue is that ,the ITIL role corresponding to inherited=true either got deleted or ddin't get to attach to the user's roles at all.

How to find out who has deleted a user's role apart from sys_audit table ,sys_audit_role table and  sys_audit_delete tables and from logs?

I searched for all the above and found zero results. 

Also sys_audit_role table does not have any data currently.

Request you to kindly help me and guide me through.

Thanking you in advance,

Sai

 

8 REPLIES 8

Mark Roethof
Tera Patron
Tera Patron

Hi there,

You might check the Deleted Records.

System Definition > Deleted Records
Table name = sys_user_has_role

The created_by on these individual records is who initiated the deletion.

If my answer helped you in any way, please then mark it as helpful.

Kind regards,
Mark

---

LinkedIn

 

Kind regards,

 

Mark Roethof

Independent ServiceNow Consultant

10x ServiceNow MVP

---

 

~444 Articles, Blogs, Videos, Podcasts, Share projects - Experiences from the field

LinkedIn

sys_audit_role IS NOT audited.

Deleted records table will have records only for tables whose audit is turned on.

 

Alternative is to find who deleted user roles from Node logs.

 

 

Regards,

Sachin

 

 

Out-of-the-box what I described, is available. Tested on a fresh PDI.

Kind regards,
Mark

---

LinkedIn

 

Kind regards,

 

Mark Roethof

Independent ServiceNow Consultant

10x ServiceNow MVP

---

 

~444 Articles, Blogs, Videos, Podcasts, Share projects - Experiences from the field

LinkedIn

Hi Sachin,

 

Node logs show an error "unable to open log file localhost_log.<end date>.txt".

Request for an alternative.

 

Thanks&Regards,

Sai