Service Manager / Service Center Practitioners Forum

Identifying who did it

New Member.

Identifying who did it

Hello guys.

We had a small problem today.

Someone purged the operator table. He didn't delete the table but the data inside.

Any idea how we could find out who did it?

Thanks for the help.


Outstanding Contributor.

Re: Identifying who did it



 syslog triggers information about the user's login logout and user sessions - not sure if it can provide information about purging the data from table but at least you will know about the user's session  at that time

HP Support
If you find that this or any post resolved your issue, please be sure
to mark it as an accepted solution.
Please also give kudo if you find it interesting :)
Honored Contributor.

Re: Identifying who did it

DO u have Audit enabled? If yes you can check there as well




Micro Focus Expert

Re: Identifying who did it


Not sure if this will help but

The Audit Log File is the repository for data gathered during the audit. It displays the old and new values of input field data, as well as who made the revisions and when. The log is a record of all update transactions for the specified source file. The system adds one log record per source record update when you update one or more of the source record input fields defined in the Audit Specifications file.

Note: The following procedure displays a list of audit log records only if you have made modifications to contacts records after creating the audit specifications record. Otherwise, the log record is empty

"HP Support
If you find that this post or any post resolves your issue, please make sure to mark it as an accepted solution."
Acclaimed Contributor.

Re: Identifying who did it

In the mysteries, it's always the butler that did it.

Not sure if purge event is captured in the sysmodtime and sysmoduser fields but if the sysmodtime matches, you can start questioning that sysmoduser. Check those fields for the operator table and the operator's dbdict table.


John Stagaman
Acclaimed Contributor.

Re: Identifying who did it

Sadly, after testing a manual purge/reset of a table, it appears that nothing is written to either the sm.log or the msglog. I don't see anyway to identify who deleted the records.

Kudos - what, where, how, and why
Want Good Answers? Ask Good Questions...
Acclaimed Contributor.

Re: Identifying who did it


As said above, three is oob No way at all to track the operator or time or anything else in such scenario.

You can only predict by using the time at which error starts coming and mapping with syslog table/sm.log (for operator logged in at that time)

At db end you can exactly find the time of this activity (if reasonable tracking enabled) and then map sm login time of users.

Assign Kudo, if found post useful and mark it accepted if solves the issue.
New Member.

Re: Identifying who did it

Thanks guys for the help. It was usefull, but crazy, since there were too many users loged on.

Anyway, thaks for the ideas.

Can I give kudos to everyone?:D


Dennis Handly
Acclaimed Contributor.

Re: Identifying who did it

>Can I give kudos to everyone?


Yes, you can assign kudos to any post (that's not yours) that's helpful.


If you are the author of the topic, you can select one post as the Solution, even yours.