Audit Delete Table not capturing the deletion
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-21-2022 06:59 AM
Hi.
I recently ran across a problem with the sys audit delete table's ability to capture deleted records. The problem was that I had deleted an application record from the cmdb ci appl table, but the operation was not recorded under the sys audit delete . However, the record had been deleted from the cmdb ci appl table,I confirmed from systemdefinition->dictionary that the table cmdb ci appl table dont have any attribute named No audit delete.
Any inputs which can address this issue is much appriciated.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-21-2022 11:57 AM
Hi Phani,
The Audit Deleted records are recording the deletion with the table extension name.
cmdb_ci_appl table will usually not be shown. It will be one of the many extensions of that table.
Search with Updated or Updated by or Display value if you have the exact name of the CI.
Regards.
JP
JP

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
07-23-2022 05:29 PM
As JP said there are 137 tables that exend the cmdb_ci_appl table. Most likely the record deleted was in one of the children tables, thus you are not able to find an entry denoted as cmdb_ci_appl. This query will list the 137 tables that extend the cmdb_ci_appl table.
https://YOURINSTANCE.service-now.com/sys_db_object_list.do?sysparm_query=super_class%3D436f98b9db0300100f096f7748961932