Check update fields without audit log

John91 · ‎06-12-2023

Hi there,

I don't check Audit field of sys_user table (collection) but I want to know who changed certain user record and which fields were changed.

Is there any way to confirm?

I suspeced that I could check Transaction Log but it seems not to have such information.

Please let me know.

Thanks.

Tony Chatfield1 · ‎06-12-2023

Hi, if you are not auditing the table then I suspect that there is little data available to review.
As you mentioned you might be able to see who navigated to the record (or table) via the transaction logs
You could also check the Event log incase the update generated a sysevent,

You may also be able to search your logs via Node Log File Browser

but these options are less than ideal with visibility limitations and/or time constraints.

Potentially you could also download log files from your instance nodes and search these,
but not very practical if you have a lot of nodes or the log files are large.

As suggest by other users in this thread, I would consider enabling audit on your table so that you don't have this issue in the future.

View solution in original post

Adrian Ubeda · ‎06-12-2023

Hi John 91,

Maybe with history list you can achieve that, because it displays each change made in the row. Inside the record, burguer icon > history > calendar.

Check this useful links as well: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0724318

https://docs.servicenow.com/bundle/utah-platform-security/page/administer/security/reference/r_Histo...

If it was helpful, please give positive feedback! ✔
☆ Community Rising Star 22, 23 & 24 ☆

John91 · ‎06-12-2023

Hi Adrian, thanks for your quick reply.

Your suggestion is quite useful, but I want to confirm which record was changed too.

Do you have any idea about it?

Riya Verma · ‎06-12-2023

Hi @John91 ,

Hope you are doing great.

check if audit checkbox selected for sys_user table.
Open the "User Administration" application.
Search for and open the user record for which you want to track changes.
In the user record form, click on the "Related Links" button.
From the dropdown menu, select "View Audit History".

To further enhance the audit functionality and tailor it to your specific requirements, you can consider the following customizations:

Configure field-specific auditing: By default, ServiceNow audits all fields in a table. However, you can customize the auditing settings to track only specific fields that are relevant to your business needs. This can be achieved by modifying the field properties and enabling auditing for those fields.
Customize the audit log display: If you want to view additional details or specific fields in the audit history, you can customize the form layout of the "sys_audit" table. This customization allows you to display the desired fields in a more user-friendly format.

Please mark the appropriate response as correct answer and helpful, This may help other community users to follow correct solution.
Regards,
Riya Verma

John91 · ‎06-12-2023

Hi @Riya Verma

Thank you for your suggestion, but currently the audit cehckbox isn't selected and I want to look at the existing change information.
Your suggestion seems the solution after selecting audit checkbox.
So please tell me if you have any idea about this.