Historical CI / Server Status Changes

[cabradbury]

We use Service Now and CMDB at our organization. Recently I had a member of our Windows Engineering team ask about getting information on all the servers which have had their status changed from Active to Inactive (or any status change at all) during a particular time frame. Initially I was asked if Performance Analytics could do this, and while, I believe we could set it up to do so going forward, this doesn't help us with the past data.

My next question was if there was a log or some auditing that took place on any changes in the system in general. For instance, I can look at an incident and see when it was created, who it was assigned to originally, who it was reassigned to and when, etc.. I am hoping the same information resides somewhere in SN for CIs s well. Has anyone ever done this? I was told there is an audit log, but it was dangerous to access as when doing so with no filtering it crashes your session because it is so big.

Ideally, I'd like to be able to use the ODBC driver or even the SN reporting tools to query a log or a historical account of each CI or server and see if the status was ever changed. I don't mind parsing text, as long as all the information is there, but not sure where to start. Thanks in advance for any help!!

[BenPhillipsSNC]

Hi Charles,

Yes, for the cmdb_ci tables, auditing is usually turned on. You can view audit history by following steps like these:

Viewing a Record's Change History - ServiceNow Wiki

In servicenow there is the concept of a History Set. More on that: Viewing History Sets - ServiceNow Wiki

Some info on the Audit table itself: Understanding the sys audit Table - ServiceNow Wiki

it was dangerous to access as when doing so with no filtering it crashes your session because it is so big.

Yes, this is why we have the concept of a history set.

use the ODBC driver or even the SN reporting tools to query a log or a historical account of each CI or server and see if the status was ever changed

Using the ODBC is going to be tricky, because you will have to query something like the sys_audit table directly, and so you will need to have your query be specific enough to get the results you need without bogging down the system or having your transaction cancelled.

There is a way you can view an open list without actually sending a query to the database:

/sys_audit_list.do?sysparm_filter_only=true

This tells the system "yes, i'm going to load the entire audit table, but don't query it! just display the filter at the top!" then you can set your filter to something like "created on > today" and then run it. Then once you have a query you like, you could then maybe try copying the query and use it in your ODBC.

Thanks

[cabradbury]

Ben,

Thanks this give me some good insight. Still trying to determine a way we can pull that information, however, I think our Service Now team has figured out a way to use metrics or some other feature to track these. Do you have experience with tracking when CI status is changed? Is there a preferred method within the industry that is recommended?

Charles

[BenPhillipsSNC]

No I don't have personal experience with that. You might want to create a new Event if one doesn't exist, that is generated when a CI is updated. For example, you could call it "cmdb_ci.status.changed".

[cabradbury]

Ben,

Thanks! I'll work with our guys over here on our Service Now admin team. Thanks so much!

Charles