Some information in CA SAM has been removed. How can we find out who or what removed it?

Document ID : KB000073124
Last Modified Date : 13/03/2018
Show Technical Document Details
Question:
Some of the data in CA SAM has been removed.  We do not know if it was done by a job or by a user. How can we find out more details about what or who removed this data?
Answer:
This information is held in the history table. To investigate this problem, follow these steps:

1. Log in to CA SAM as a super user and go to Admin > Monitoring > Browse history
2. Select the table you need to look into.
3. Select columns Login (User, History) and SID (step, import, history)
4. In the column action, filter for "delete" (history tables tend to be large, so this could take some time)
5. Identify the process or user who deleted the records.

This should tell you who or what removed this information.