The community will be in read-only from Tuesday 11:59pm (PST) to Wednesday 7:30am (PST)
The community will be in read-only from Tuesday 11:59pm (PST) to Wednesday 7:30am (PST)
Service Desk Practitioners Forum
cancel
Showing results for 
Search instead for 
Did you mean: 

track down deleted CI in CMDB

Highlighted
Anton Sugito
Acclaimed Contributor

track down deleted CI in CMDB

Hi Guys,

 

I have a deleted CI in the HP Service Desk 4.5. I was wondering if we can trace down 'who' delete that CI in hpsd.

At the moment, unfortunately everyone in hpsd can delete a ci.

 

Thanks,

6 REPLIES
Anton Sugito
Acclaimed Contributor

Re: track down deleted CI in CMDB

im using service desk 4.5 sp26 and oracle 10g. the audit fault of database is off and the database is cluster database if that's help

viprom
HPE Expert

Re: track down deleted CI in CMDB

Hi Anton,

 

Up to my knowledge the short answer of this question is 'no' .... unfortunately. You won't be able to find anywhere in logs records containing the name of the user deleted the CI.

 

But in future, maybe you can prepare a query that tracks all the 'delete' actions on DB level ... but keep in mind that this may influence the performance.

Other thing could be to check in Oracle the time when this CI was deleted.
Then check the log which users were logged at that time ....
but this won't give only one name probably...

-----
If you find this or other posts helpful, please do not forget to click the Kudo Star or to mark it as a Solution if you are the owner of the thread. Thanks :)
Anton Sugito
Acclaimed Contributor

Re: track down deleted CI in CMDB

Thank you for your reply first of all. I am not entirely sure when is the timestamp the ci was deleted.  as for the log that record the timestamp of user login to hpsd, where is that log? is that the databaselog? or serverlog?

viprom
HPE Expert

Re: track down deleted CI in CMDB

This is the SD server log.

-----
If you find this or other posts helpful, please do not forget to click the Kudo Star or to mark it as a Solution if you are the owner of the thread. Thanks :)
The Pike
Honored Contributor

Re: track down deleted CI in CMDB

If memory serves me right, since SP11, HPSD also includes Enhanced Auditing, which, when enabled will allow you to track down item deletion based on SD items.  Of course, it's not a feature that will work retroactively so you will not be able to track down previous deletions but given that anyone and everyone can delete CIs in your system - i'd sure as hell enable it and then get to re-configuring my security settings.

jpmora
Occasional Contributor

Re: track down deleted CI in CMDB

Hi,

 

Not sure if you can track down a record that was already deleted, however, maybe you can create a trigger against that table(before delete action) for future deletions, you can use the following code to write down a new line in the log who/when something is deleted from that table.

 

var rcode="";
system.functions.rtecall

("log", rcode,"<HPSupport> Record: "+ record.XXXXXX +" has been deleted. Operator: "+system.functions.operator() +" Time: "+system.functions.tod())

 

* records.XXXXXX, where XXXXX is the field you want to use as reference.

 

Jose Pablo Mora

HP Support

//Add this to "OnDomLoad" event