Finding the job which deleted a user

[lambert-giese]

Dear experts,

is there any way to see in the SAP IDM 8.0 database which job ID has deleted an entry, such as an MX_PERSON? In table MXI_ENTRY, I see that deleted MX_PERSONs are still available with mcentrystate=2. I'm also aware that MXIV_OENTRIES has the information about each attribute that has been deleted, such as MSKEYVALUE.

The funny thing is that the USERID column in MXIV_OENTRIES, which I expected to contain the information about which job ID or user ID performed each attribute's deletion, just contains the information "Entry deleted", plus some information about which job (or which user) has created the original value before deletion.

There's no mention of the job ID that performed the actual deletion, though.

Any ideas?

[Former Member · Accepted solution]

Hi Lambert,

if you delete an object via ToIdentityStore-Pass, the dispatcher calls mxie_delete (=> mxie_delete_mskey).
This procedure does not store any job-information, but it keeps the timestamp of deletion as mcLastModified in mxi_entry.

You might be lucky and find some traces in mcv_executionlog_list.
It contains information from both, tasks/processes and regular jobs:

select  * from mcv_executionlog_list where mcMSKEY = <MSKEY> order by mcLogTime desc

select  * from mcv_executionlog_list where mcLogTime between <DATETIME1> and <DATETIME2>

(Depending on your housekeeping-settings (Execution log: Clean up) the table mc_execution_log might not store those information anymore.)

Lennart

[lambert-giese · Accepted solution]

Great, that works - at least when the related execution log data has not been cleaned up yet . Thank you!

[brandonbollin]

Can you use the MSKEY of this deleted entry to search the audit logs? Maybe there's something in there.

[lambert-giese]

Brandon, do you mean mxp_audit or any of its views? I searched that, but the only information I find there (as expected) is information created by provisioning tasks and their jobs. Regular jobs, in contrast, do not create any audit information in mxp_audit, as far as I know.

The MSKEY relevant to this question has been deleted by a regular (scheduled) job. The question is: which one?

[brandonbollin]

Can you show the total results of your query into the oentries table that you have pictured above? I mean, all columns, everything related to that entry? I think there's a column in there that will tell us what happened but I only see a small portion of your results in your screenshot.

[lambert-giese]

Thanks Brandon. Unfortunately, I cannot share more than what I provided above for data privacy reasons - this problem occurs in a customer system. Trust me, however, that the result set in its entirety (all rows and columns) doesn't contain the information I'm looking for.

[devaprakash_b]

Hi Lambert,

Did u check idmv_ovalue_basic_all view by using the deleted entry mskey. i believe here we might find the jobid with which the entry has been deleted.

Regards,

Deva

[lambert-giese]

I checked idmv_ovalue_basic_all, and it seems to contain more or less the same information as mxiv_oentries. Both views seem to be based on the same table. There's no information in there as to which regular job deleted the MSKEY I'm interested in.