Re: Identifying who did it (119 Views)
Reply
Occasional Visitor
Costy
Posts: 2
Registered: ‎10-31-2011
Message 1 of 9 (200 Views)

Identifying who did it

Hello guys.

We had a small problem today.

Someone purged the operator table. He didn't delete the table but the data inside.

Any idea how we could find out who did it?

Thanks for the help.

 

Please use plain text.
Honored Contributor
DimitarPeychev
Posts: 288
Registered: ‎11-01-2011
Message 2 of 9 (181 Views)

Re: Identifying who did it

Hi,

 

 syslog triggers information about the user's login logout and user sessions - not sure if it can provide information about purging the data from table but at least you will know about the user's session  at that time

HP Support
If you find that this or any post resolved your issue, please be sure
to mark it as an accepted solution.
Please also give kudo if you find it interesting :)
Please use plain text.
Frequent Advisor
ArpitAggarwal07
Posts: 81
Registered: ‎09-10-2013
Message 3 of 9 (178 Views)

Re: Identifying who did it

DO u have Audit enabled? If yes you can check there as well

 

Regards

AA

Please use plain text.
HP Expert
lisajo
Posts: 480
Registered: ‎02-15-2010
Message 4 of 9 (176 Views)

Re: Identifying who did it

HI

Not sure if this will help but

The Audit Log File is the repository for data gathered during the audit. It displays the old and new values of input field data, as well as who made the revisions and when. The log is a record of all update transactions for the specified source file. The system adds one log record per source record update when you update one or more of the source record input fields defined in the Audit Specifications file.

Note: The following procedure displays a list of audit log records only if you have made modifications to contacts records after creating the audit specifications record. Otherwise, the log record is empty

"HP Support
If you find that this post or any post resolves your issue, please make sure to mark it as an accepted solution."
Please use plain text.
Esteemed Contributor
Jas1
Posts: 364
Registered: ‎04-05-2010
Message 5 of 9 (158 Views)

Re: Identifying who did it

In the mysteries, it's always the butler that did it.

Not sure if purge event is captured in the sysmodtime and sysmoduser fields but if the sysmodtime matches, you can start questioning that sysmoduser. Check those fields for the operator table and the operator's dbdict table.

 

Please use plain text.
Honored Contributor
John Stagaman
Posts: 3,136
Registered: ‎07-13-2007
Message 6 of 9 (149 Views)

Re: Identifying who did it

Sadly, after testing a manual purge/reset of a table, it appears that nothing is written to either the sm.log or the msglog. I don't see anyway to identify who deleted the records.

----------------------------------------------------
Kudos - what, where, how, and why
Want Good Answers? Ask Good Questions...
Please use plain text.
Honored Contributor
Piku
Posts: 3,670
Registered: ‎06-17-2010
Message 7 of 9 (141 Views)

Re: Identifying who did it

Hi,

As said above, three is oob No way at all to track the operator or time or anything else in such scenario.

You can only predict by using the time at which error starts coming and mapping with syslog table/sm.log (for operator logged in at that time)

At db end you can exactly find the time of this activity (if reasonable tracking enabled) and then map sm login time of users.

hth,
Please use plain text.
Occasional Visitor
Costy
Posts: 2
Registered: ‎10-31-2011
Message 8 of 9 (119 Views)

Re: Identifying who did it

Thanks guys for the help. It was usefull, but crazy, since there were too many users loged on.

Anyway, thaks for the ideas.

Can I give kudos to everyone?:D

 

Please use plain text.
Acclaimed Contributor
Dennis Handly
Posts: 24,750
Registered: ‎03-06-2006
Message 9 of 9 (102 Views)

Re: Identifying who did it

>Can I give kudos to everyone?

 

Yes, you can assign kudos to any post (that's not yours) that's helpful.

http://h30499.www3.hp.com/t5/help/faqpage/faq-category-id/kudos#kudos

 

If you are the author of the topic, you can select one post as the Solution, even yours.

http://h30499.www3.hp.com/t5/help/faqpage/faq-category-id/solutions#solutions

Please use plain text.
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation