sys_audit "fieldname": "DELETED"

nimzo88
Giga Contributor

‎02-01-2024 02:36 AM

Hello, 

I am examining the sys_audit table, 

and I see many records with fieldname = "DELETED"

        {
            "fieldname": "DELETED",
            "reason": "",
            "sys_id": "<the_sys_id>",
            "newvalue": "DELETED",
            "sys_created_on": "<the_timestamp>",
            "documentkey": "<the_document_key>",
            "internal_checkpoint": "",
            "record_checkpoint": "-1",
            "tablename": "<the_table_name>",
            "user": "system",
            "oldvalue": "DELETED",
            "sys_created_by": "system"
        },

what is the meaning of such events? one example of such event is for table "ais_ingestion_trigger_checkin" .

Is this an internal system process ? 

 

0 Helpfuls
  • 496 Views
1 REPLY 1

Ricardo Velez
ServiceNow Employee
ServiceNow Employee

‎12-05-2024 06:44 AM

This shows when the target record (DocumentID) was deleted from the platform so it is no longer present on source table.  The deleted record should be found in the sys_audit_delete table and if the deleted record is recovered then an audit record will be created with the fieldname/oldvalue/newvalue set to RECOVERED.

0 Helpfuls