Audit Delete Table not capturing the deletion

phani varma
Tera Contributor

‎07-21-2022 06:59 AM

Hi.

 

I recently ran across a problem with the sys audit delete table's ability to capture deleted records. The problem was that I had deleted an application record from the cmdb ci appl table, but the operation was not recorded under the sys audit delete . However, the record had been deleted from the cmdb ci appl table,I confirmed from systemdefinition->dictionary that the table cmdb ci appl table dont have any attribute named No audit delete.

Any inputs which can address this issue is much appriciated.

0 Helpfuls
  • 1,090 Views
2 REPLIES 2

JP - Kyndryl
Kilo Sage

‎07-21-2022 11:57 AM

Hi Phani,

The Audit Deleted records are recording the deletion with the table extension name.

cmdb_ci_appl  table will usually not be shown.  It will be one of the many extensions of that table.

Search with Updated  or  Updated by   or   Display value   if you have the exact name of the CI.

 

Regards.

JP

 

Regards,
JP
0 Helpfuls

Scott Halverso1
Mega Guru
Mega Guru

‎07-23-2022 05:29 PM

As JP said there are 137 tables that exend the cmdb_ci_appl table.  Most likely the record deleted was in one of the children tables, thus you are not able to find an entry denoted as cmdb_ci_appl.  This query will list the 137 tables that extend the cmdb_ci_appl table.

https://YOURINSTANCE.service-now.com/sys_db_object_list.do?sysparm_query=super_class%3D436f98b9db0300100f096f7748961932

0 Helpfuls