Query in Database Regarding Deleted Baseline

Hi All,

Is there a way to know who deleted my baselines?
I have seen in the database the “LastModifier = 9” but I dont know how to search the user/operator “9”.

Which table is this belong so that we can query and found who is responsible.

Thank you.

Hello Pogi,

Please try the following query:

select Username
from USERINFO
where MastheadUsername = (
select Username
from LOCAL_OBJECT_DEFS P
inner join VERSIONS V on P.ID = V.ID AND P.Version = V.LatestVersion
where P.ParentID = 1 AND dbo.fn_ExtractField('CustomSiteName', 0, P.Fields) = 'test1' 
AND Name = 'I''m deleting this baseline'
)

My baseline was located in the custom site “test1” and it’s name was: "I’m deleting this baseline"
Note in a query a single quote in a name had to be repeated twice.

Regards,
Vitaliy

1 Like

This works Sir, Thanks alot :slight_smile:

Hi Sir @vnovik,

I have Identified who deleted the baseline now thanks for your help.

What about the deployment Sir, Can I query in the database who deployed the specific baseline?

Thank you so much for the help.

Regards,
Jay

Deployed actions (even from baselines) will appear in the Console unless also deleted.

Again, I would recommend contacting support here if querying the BigFix database directly is required.

1 Like