Re: Identifying who did it (264 Views)
Reply
Occasional Visitor
Costy
Posts: 2
Registered: ‎10-31-2011
Message 1 of 9 (345 Views)

Identifying who did it

Hello guys.

We had a small problem today.

Someone purged the operator table. He didn't delete the table but the data inside.

Any idea how we could find out who did it?

Thanks for the help.

 

Honored Contributor
DimitarPeychev
Posts: 297
Registered: ‎11-01-2011
Message 2 of 9 (326 Views)

Re: Identifying who did it

Hi,

 

 syslog triggers information about the user's login logout and user sessions - not sure if it can provide information about purging the data from table but at least you will know about the user's session  at that time

HP Support
If you find that this or any post resolved your issue, please be sure
to mark it as an accepted solution.
Please also give kudo if you find it interesting :)
Regular Advisor
ArpitAggarwal07
Posts: 104
Registered: ‎09-10-2013
Message 3 of 9 (323 Views)

Re: Identifying who did it

DO u have Audit enabled? If yes you can check there as well

 

Regards

AA

HP Expert
lisajo
Posts: 480
Registered: ‎02-15-2010
Message 4 of 9 (321 Views)

Re: Identifying who did it

HI

Not sure if this will help but

The Audit Log File is the repository for data gathered during the audit. It displays the old and new values of input field data, as well as who made the revisions and when. The log is a record of all update transactions for the specified source file. The system adds one log record per source record update when you update one or more of the source record input fields defined in the Audit Specifications file.

Note: The following procedure displays a list of audit log records only if you have made modifications to contacts records after creating the audit specifications record. Otherwise, the log record is empty

"HP Support
If you find that this post or any post resolves your issue, please make sure to mark it as an accepted solution."
Honored Contributor
Jas1
Posts: 433
Registered: ‎04-05-2010
Message 5 of 9 (303 Views)

Re: Identifying who did it

In the mysteries, it's always the butler that did it.

Not sure if purge event is captured in the sysmodtime and sysmoduser fields but if the sysmodtime matches, you can start questioning that sysmoduser. Check those fields for the operator table and the operator's dbdict table.

 

Honored Contributor
John Stagaman
Posts: 3,522
Registered: ‎07-13-2007
Message 6 of 9 (294 Views)

Re: Identifying who did it

Sadly, after testing a manual purge/reset of a table, it appears that nothing is written to either the sm.log or the msglog. I don't see anyway to identify who deleted the records.

----------------------------------------------------
Kudos - what, where, how, and why
Want Good Answers? Ask Good Questions...
Honored Contributor
Piku
Posts: 4,128
Registered: ‎06-17-2010
Message 7 of 9 (286 Views)

Re: Identifying who did it

Hi,

As said above, three is oob No way at all to track the operator or time or anything else in such scenario.

You can only predict by using the time at which error starts coming and mapping with syslog table/sm.log (for operator logged in at that time)

At db end you can exactly find the time of this activity (if reasonable tracking enabled) and then map sm login time of users.

hth,
____________________________________
Assign Kudo, if found post useful and mark it accepted if solves the issue.
Occasional Visitor
Costy
Posts: 2
Registered: ‎10-31-2011
Message 8 of 9 (264 Views)

Re: Identifying who did it

Thanks guys for the help. It was usefull, but crazy, since there were too many users loged on.

Anyway, thaks for the ideas.

Can I give kudos to everyone?:D

 

Acclaimed Contributor
Dennis Handly
Posts: 25,281
Registered: ‎03-06-2006
Message 9 of 9 (247 Views)

Re: Identifying who did it

>Can I give kudos to everyone?

 

Yes, you can assign kudos to any post (that's not yours) that's helpful.

http://h30499.www3.hp.com/t5/help/faqpage/faq-category-id/kudos#kudos

 

If you are the author of the topic, you can select one post as the Solution, even yours.

http://h30499.www3.hp.com/t5/help/faqpage/faq-category-id/solutions#solutions

The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation.