{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40788,"path":"platform-security/c_UnderstandingTheSysAuditTable.md","title":"Viewing Sys Audit and Audit Relationship Change tables","bundle":null,"doc_type":null,"release":"australia","body":"\n# Viewing Sys Audit and Audit Relationship Change tables\n\nThe ServiceNow AI Platform tracks inserts and updates to audited records in the Sys Audit \\(sys\\_audit\\) and Audit Relationship Change \\(sys\\_audit\\_relation\\) tables.\n\nThe ServiceNow AI Platform tracks audit tables. To track tables, select the **Audit** check box in the dictionary record to set the value to true. By default, it does not audit records from system tables, such as update sets tables.\n\n**Note:** To prevent performance issues and infinite loops, the system skips any business rule or workflow triggered by inserts to the Sys Audit table.\n\n## Sys audit table columns\n\nAccess the Sys Audit table on your instance by entering `sys_audit.list` in the navigation filter.\n\nThe following columns appear in the sys\\_audit table records:\n\n<table id=\"table_jbh_cj1_l1b\"><thead><tr><th>\n\nField\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nTable name\n\n</td><td>\n\nTable that the audit record is for \\(for example, \"`incident`\"\\)\n\n</td></tr><tr><td>\n\nField name\n\n</td><td>\n\nColumn in the table that the audit record is for \\(for example, \"`assigned_to`\"\\)\n\n</td></tr><tr><td>\n\nDocument key\n\n</td><td>\n\nSys\\_id \\(Unique Record Identifier\\) for the originating record associated with the audit record.\n\n</td></tr><tr><td>\n\nUser\n\n</td><td>\n\nName of the user who created the change.\n\n **Note:** Some automated processes use the system or guest user to apply and track changes to records. For more information, see [System and guest users](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/user.md#system-guest-users).\n\n</td></tr><tr><td>\n\nOld value\n\n</td><td>\n\nOld value of the field change represented by this sys\\_audit record.\n\n -   Reference fields: Unique sys\\_id value of the changed record.\n-   Date and time fields: Value in Coordinated Universal Time \\(UTC\\) as stored in the database.\n\n</td></tr><tr><td>\n\nNew value\n\n</td><td>\n\nNew value of the field change represented by this sys\\_audit record.\n\n -   Reference fields: Unique sys\\_id value of the changed record.\n-   Date and time fields: Value in Coordinated Universal Time \\(UTC\\) as stored in the database.\n\n</td></tr></tbody>\n</table>## How the Audit Relationship Change \\(sys\\_audit\\_relation\\) table works\n\nThe Sys Audit \\[sys\\_audit\\] table tracks changes to reference fields in tables that are flagged for auditing. This activity includes journal field entries and history sets. The Audit Relationship Change \\[sys\\_audit\\_relation\\] table tracks relationship changes between sys\\_audit table records and the source tables that the audited records originate from. It also tracks when a record might have been deleted.\n\n-   -   Whenever you audit any record in a table, a relationship is created between the various originating tables to the store that records data. This relationship information is saved in the sys\\_history\\_set, sys\\_history\\_line, and sys\\_journal tables.\n-   If you delete a field that is related to an audited table record, the sys\\_audit\\_relation table records the deletion. In other words, anytime you change an audited record, it first deletes past elements, and then creates a relationship in the sys\\_audit\\_relation table with new document IDs.\n\n"}}