You are viewing limited content. For full access, please sign in.

Discussion

Discussion

Audit Report Criteria for Deletions

posted on November 20, 2014

I have a scenario where I need to run an Audit on ALL documents deleted that had template fields values = Processed or Paid.  I can't seem to get an accurate Audit Report.  If I try to run just the default "Deletions" report, and then add my filters...there's no option to filter off Field Values.  Any suggestions would be greatly appreciated. 

0 0
replied on November 20, 2014

Each event written to the audit log contains just the specifics of that event.  Deletion events contain information about who did the deleting, when they did it, and which entry was deleted.  It does not include secondary information such as metadata attached to the entry at the time of deletion.

The kind of query you can try to run against the audit data would be more like looking for an entry that was deleted and at one point had the status field set to "Paid".  You might be able to also filter out entries where the status field was subsequently written to with another value, but that would be tricky.  The web UI doesn't support these kinds of queries, this would be something you'd have to write yourself.  The audit documentation includes descriptions of the schema and event values.  Since a single set field event can contain multiple field assignments, looking for a particular one might be hard (Let me know if you want to pursue this route and I'll look into it).  And of course you can find only those events that have been loaded into the reporting database, so you could miss the field assignment event if it happened long enough ago.

I think you'll want to take another approach to this.  If you need to record metadata at the time of deletion, maybe you can have a workflow write that to an external database?  Or if you're trying to prevent this situation, maybe remove delete rights and have a process that verifies the field data?

0 0
replied on November 21, 2014

Bryan,

Let me clarify something that perhaps will add some insight to my objective.  This is a one time Audit that needs to be run.  We had a rogue workflow that moved a bunch of documents that had already been processed in the workflow...and it moved them back to users folders, where they deleted them.  We simply are looking to find all the documents for a specific date range that were deleted and contained the field status of paid or processed so that we can restore those documents back to Laserfiche.

0 0
replied on November 21, 2014

The part that's hard to do with AT is to determine the assigned metadata at a point in time.  It should be straight-forward to get a list of entries that were moved by Workflow and deleted by a user in a particular time frame (though you might end up writing your own query for this).  What you might do from there is query a repository SQL database that you've restored from a backup taken at that time to see which of those fit your metadata requirements.  Of course this assumes that your process moved slowly enough that there was a backup taken between setting the field value to "Paid" and the deletion and that you still have access to that backup.  If you don't have a usable backup, maybe you can think of another way to split this problem into the half that AT is good at and the half that's best approached from another angle.

0 0
replied on December 3, 2014

I'm confused as to why what I want to accomplish is so difficult to do with AT?  All I'm looking to do is find any document deleted in a date range that had a certain field status.  Not sure how to do that in SQL...but figured AT should be able to do that as it seems relatively straight forward.

0 0
replied on December 3, 2014

It's difficult because the deletion event contains no record of the entry's metadata at the time of the deletion.

0 0
replied on December 3, 2014

Is there any plan to add that? Seems to me that when a document is deleted, one should be able to see all metadata relevant to that document that was deleted.  Seems like it would make sense to have that functionality in AT...be able to narrow down your filters based upon additional metadata.

0 0
replied on December 3, 2014

Are the deleted documents still in the Recycle Bin?  If so, then you may be able to query the Repository DB for what you need instead of the AT DB.
 

0 0
replied on December 3, 2014

No...that's the issue...they are purged every 7 days...so I need to figure out what documents were deleted between a date range and have a status of Paid or Processed.  Apparently AT can't do that.

0 0
replied on December 3, 2014

In your situation, I would probably use AT to create a list of Entry IDs deleted in the time period you are looking for.  Then set up a temp LF server and restore as close to the event as you can.  Using SDK, process the list of IDs from AT to check if the Entry meets the requirements for restore and if so, place it in a temp folder.  After all entries are processed, briefcase the temp folder to bring them back into the production server.

0 0
replied on December 3, 2014

We don't have any plans to record to the audit log an entry's metadata at delete time.

0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.