Undelete action within an action group

Usage and Config Platform
1

Hi Guys,

Can we undelete an action that is member of a deleted action group?
We have tried the exec_undeleted and clear console cache and verified that isdeleted column in database is “0” but the action did not appear in the console.

Thanks,
Braian

2

You would have to undelete the entire multi-action group, which is a bit tricky and I’m not sure covered by any available scripts. What are you trying to do with the undeleted action? Just looking for audit information?

1 Like
3

Hi Steve,

Yes its for audit. We’re trying to find who patch list of servers.

Thanks,
Braian

4

This is something that I wish this product did a better job of. Even a log of some kind would be awesome. I don’t know how to do it, but I thought it was possible to query the database for such information if you have the available knowledge to do so, unless it was actually purged from the database and not just deleted??

5

We can still query the action, but were unable to undeleted it and load back to console.

6

If you just want to see who deployed it, that information is available for every action within the action group. Run this query replacing nnn with the ID of the member action in question

select ID,Name,CONVERT(xml,CONVERT(varbinary(max),Fields)) from ACTION_DEFS where ID=nnn

The xml field will contain all the details of the action including the Issuer listed as __op_xxx where xxx is a number. Find the name of that operator using

select Username from USERINFO where MastheadUsername like '__op_xxx'
1 Like
7

Hi Steve,

How can we get the nnn (id) and the xxx (number)?

Thanks,
Braian

1 Like
8

Here is the link to match up the user to the opsite name once you find the “op_xxx” from above: Opsite to actual user mapping

(from the old forum:) https://www.ibm.com/developerworks/community/forums/html/topic?id=77777777-0000-0000-0000-000014942161

1 Like
9

Since you made some attempts to undelete the action and confirmed the isDeleted column is 0, don’t you already know the action id? If not, what info do you have to identify the action?

The xxx for the operator id will be in the output of the first query.

1 Like
10

It might be helpful to know what info you do know that you are trying to use. Do you know any of the action IDs? User? Timeframe? Source Fixlets?

11

Hi James,

We know the action group ID, can we undeleted group action using group ID?Thanks

12

I don’t have a lot of experience doing this, but I imagine you can just query the DB directly without undeleting it to figure out who took the action. See this response: Undelete action within an action group

You might also be able to check the ActionHistory.db on the endpoints you are interested in.