syslog triggers information about the user's login logout and user sessions - not sure if it can provide information about purging the data from table but at least you will know about the user's session at that time
HP Support If you find that this or any post resolved your issue, please be sure to mark it as an accepted solution. Please also give kudo if you find it interesting :)
The AuditLog File is the repository for data gathered during the audit. It displays the old and new values of input field data, as well as who made the revisions and when. The log is a record of all update transactions for the specified source file. The system adds one log record per source record update when you update one or more of the source record input fields defined in the Audit Specifications file.
Note: The following procedure displays a list of auditlog records only if you have made modifications to contacts records after creating the audit specifications record. Otherwise, the log record is empty
"HP Support If you find that this post or any post resolves your issue, please make sure to mark it as an accepted solution."
In the mysteries, it's always the butler that did it.
Not sure if purge event is captured in the sysmodtime and sysmoduser fields but if the sysmodtime matches, you can start questioning that sysmoduser. Check those fields for the operator table and the operator's dbdict table.