03-06-2014 07:26 AM
We had a small problem today.
Someone purged the operator table. He didn't delete the table but the data inside.
Any idea how we could find out who did it?
Thanks for the help.
03-06-2014 08:31 AM
syslog triggers information about the user's login logout and user sessions - not sure if it can provide information about purging the data from table but at least you will know about the user's session at that time
If you find that this or any post resolved your issue, please be sure
to mark it as an accepted solution.
Please also give kudo if you find it interesting :)
03-06-2014 08:46 AM
Not sure if this will help but
The Audit Log File is the repository for data gathered during the audit. It displays the old and new values of input field data, as well as who made the revisions and when. The log is a record of all update transactions for the specified source file. The system adds one log record per source record update when you update one or more of the source record input fields defined in the Audit Specifications file.
Note: The following procedure displays a list of audit log records only if you have made modifications to contacts records after creating the audit specifications record. Otherwise, the log record is empty
If you find that this post or any post resolves your issue, please make sure to mark it as an accepted solution."
03-06-2014 03:53 PM
In the mysteries, it's always the butler that did it.
Not sure if purge event is captured in the sysmodtime and sysmoduser fields but if the sysmodtime matches, you can start questioning that sysmoduser. Check those fields for the operator table and the operator's dbdict table.
03-06-2014 05:47 PM
Sadly, after testing a manual purge/reset of a table, it appears that nothing is written to either the sm.log or the msglog. I don't see anyway to identify who deleted the records.
03-06-2014 11:23 PM
As said above, three is oob No way at all to track the operator or time or anything else in such scenario.
You can only predict by using the time at which error starts coming and mapping with syslog table/sm.log (for operator logged in at that time)
At db end you can exactly find the time of this activity (if reasonable tracking enabled) and then map sm login time of users.
Assign Kudo, if found post useful and mark it accepted if solves the issue.
03-15-2014 02:10 PM
>Can I give kudos to everyone?
Yes, you can assign kudos to any post (that's not yours) that's helpful.
If you are the author of the topic, you can select one post as the Solution, even yours.