AKetteringham Posted January 22, 2021 Share Posted January 22, 2021 Hello It has come to our attention that some assets have been deleted. How can these be retrieved? I have looked back through other asset topics. Once suggests running a report using the Audit table, which I am unable to find. Regards Angela Link to comment Share on other sites More sharing options...
Victor Posted January 22, 2021 Share Posted January 22, 2021 @AKetteringham check h_sys_audit_trail table. Filter on h_table = 'h_cmdb_assets' and h_action_type = 'Delete' 22 minutes ago, AKetteringham said: How can these be retrieved? You can request a backup with Hornbill. This is a chargeable exercise. Link to comment Share on other sites More sharing options...
AKetteringham Posted January 22, 2021 Author Share Posted January 22, 2021 Hi Victor, I have found check h_sys_audit_trail table and added to my report. I am unable to find/filter on h_table = 'h_cmdb_assets' and h_action_type = 'Delete. Link to comment Share on other sites More sharing options...
Victor Posted January 22, 2021 Share Posted January 22, 2021 @AKetteringham right, I didn't realise they added friendly names to columns in this table. So it would be "Table" and "Action Type" for filter Link to comment Share on other sites More sharing options...
AKetteringham Posted January 22, 2021 Author Share Posted January 22, 2021 Hi Victor. Nearly there, just need the actual assets that have been deleted. would that be cmd_assets? Regards Angela Link to comment Share on other sites More sharing options...
Victor Posted January 22, 2021 Share Posted January 22, 2021 h_cmdb_assets is the table where all the assets are stored. The report should also filter on h_column = "h_name" Basically your filter should say: Table = h_cmdb_assets Action Type = Delete Column = h_name In the report column you can have something like: Action Type - which would be 'Delete' Action By - the user who performed the Action Type (e.g. Delete) Old Value - the value that was changed - in our scenario this will store the name of the asset (since we filter on h_name) Timestamp - date/time when the Action was performed Note: I would advise to also add a filter on Timestamp to only return actions performed in a certain timeframe (e.g. after 01/01/2021). If you need to see a different asset property in the report (e.g. asset ID) then you need to amend the value (add or add another) for the "Column" criterion in the filter (e.g. Column = h_pk_id). Link to comment Share on other sites More sharing options...
Victor Posted January 22, 2021 Share Posted January 22, 2021 ... and just seen there is already an existing topic where this was discussed: In this case I will lock this one to avoid duplicate posts. Link to comment Share on other sites More sharing options...
Recommended Posts