(imported topic written by Tim.Rice)
I’m managing a TEM/IEM environment with a large number of Console Operators.
I was asked about Auditability of actions. The theoretical situation is that a Console Operator sends out an Action, either in error or maliciously that causes a problem on endpoints, then after stopping the Action, to hide what they did, they delete the Action from the Console. Is it possible to recover the deleted Action information?
(imported comment written by cstoneba)
as long as you have ran the audit tool cleaner to and removed the deleted action from the TEM database, yes, you can retreive it. however, first you have to find the action ID.
find the action ID via SQL Querey:
select A.name as “Action Name”, A.ID, A.CreationTime
from ACTION_DEFS A, ACTION_FLAGS F
where A.ID = F.ActionID AND F.IsDeleted=1
undelete the action:
exec undelete_action
I believe this should read, “As long as you have NOT run the audit tool cleaner to remove the deleted actions…”
Plus, the query above fails with
“Msg 208, Level 16, State 1, Line 1 Invalid object name ‘ACTION_DEFS’.”
This query works as of Version 9.5.2.56
select A.name as “Action Name”, A.ID, A.CreationTime
from BFEnterprise.dbo.ACTION_DEFS A, BFEnterprise.dbo.ACTION_FLAGS F
where A.ID = F.ActionID AND F.IsDeleted=1