Viewing Sys Audit and Audit Relationship Change tables

The ServiceNow AI Platform tracks inserts and updates to audited records in the Sys Audit (sys_audit) and Audit Relationship Change (sys_audit_relation) tables.

The ServiceNow AI Platform tracks audit tables. To track tables, select the Audit check box in the dictionary record to set the value to true. By default, it does not audit records from system tables, such as update sets tables.

Note:

To prevent performance issues and infinite loops, the system skips any business rule or workflow triggered by inserts to the Sys Audit table.

Sys audit table columns

Access the Sys Audit table on your instance by entering sys_audit.list in the navigation filter.

The following columns appear in the sys_audit table records:

Field	Description
Table name	Table that the audit record is for (for example, "incident")
Field name	Column in the table that the audit record is for (for example, "assigned_to")
Document key	Sys_id (Unique Record Identifier) for the originating record associated with the audit record.
User	Name of the user who created the change. Note: Some automated processes use the system or guest user to apply and track changes to records. For more information, see System and guest users.
Old value	Old value of the field change represented by this sys_audit record. Reference fields: Unique sys_id value of the changed record. Date and time fields: Value in Coordinated Universal Time (UTC) as stored in the database.
New value	New value of the field change represented by this sys_audit record. Reference fields: Unique sys_id value of the changed record. Date and time fields: Value in Coordinated Universal Time (UTC) as stored in the database.

How the Audit Relationship Change (sys_audit_relation) table works

The Sys Audit [sys_audit] table tracks activity in tables that are flagged for auditing. This activity includes journal field entries and history sets. The Audit Relationship Change [sys_audit_relation] table tracks relationship changes between sys_audit table records and the source tables that the audited records originate from. It also tracks when a record might have been deleted.

• Whenever you audit any record in a table, a relationship is created between the various originating tables to the store that records data. This relationship information is saved in the sys_history_set, sys_history_line, and sys_journal tables.
• If you delete a field that is related to an audited table record, the sys_audit_relation table records the deletion. In other words, anytime you change an audited record, it first deletes past elements, and then creates a relationship in the sys_audit_relation table with new document IDs.