Audit on report deletion

Nick shared this question 4 months ago
Answered

Hi,

Is there a way to find the user ID's who have deleted a report?

I have gone as far as finding the event record but not sure how to tie it up with the user id:

select * from Event where eventcode = 'RPTDELETE' order by EventDate desc

Thanks,

Nick

Comments (4)

photo
1

Hi Nick,

Yes, it's the field ipsource you want to look at. Which refers to a user via the ipclass table.

The example below works on postgreSQL:

/dba96dbe7ef517b0cebbf1f74d306c69

and the statement is:

select (i.emailleft ||'@'|| i.emailright) as username,e.eventtypecode, e.eventcode, e.gmtdatetime, e.eventdate, e.eventdata from Event e
join ipclass i on i.ipid = e.ipsource
where e.eventcode = 'RPTDELETE'
order by e.EventDate desc
I hope that helps.

Kind regards,

Chris

photo
1

Hi Nick,

Hope you're doing well.

Just following up on this one. Let me know if the below helped or you need something else.

Kind regards,

Chris

photo
1

Thanks Chris. This confirmed my finding as well :)

photo
1

Hi Nick,

That's great to hear! If that's all good, I'll go ahead and mark this as complete.

Kind regards,

Chris