This audit details are not captured in any logs including appserver.log.
Thus best/only way to find more details would be to configure email/SNMP notification for the appropriate authorizations that you want to monitor/audit in the following way.
Example) To configure email or SNMP notification when the Delete authorization is exercised on a particular object type such as 'BLPackage' & 'DeployJob':
1) Log on to TSSA/BSA console as RBACAdmins role
2) Under "RBAC Manager" >> 'Authorizations' >> expand "System Authorizations" and open authorizations for those object types that are needed to be audited as below:
- BLPackage.Delete
- DeployJob.Delete
3) Check off the notification type user want to receive (email or SNMP) and input the email address or SNMP server to send the notification to.
This will send a notification when any object of this type is deleted showing the name of the object and user who deleted as below:
Content example of audit trail notification for deleting deploy Job:
Date: 2018/06/13 11:11:17+1000
Role: BLAdmins
User: ben
Object Type: Deploy Job
Object Name: <deploy job name>
Status: Access Granted
**NOTE: This may trigger email notifications being sent out by database cleanup jobs that deletes auto-generated deploy jobs.
There is another option to fetch delete activity data using database query as below.
Example SQL to review delete activity during a certain time window assuming AUDIT_TRAIL cleanup has not been run and has removed the data from the AUDIT_TRAIL table:
Oracle:
select atr.audit_trail_log_id,to_char(atr.log_date, 'YYYY-MM-DD HH24:MI:SS'),atr.role_name,atr.user_name,atr.object_name,o.name,atr.message from audit_trail atr
join object_type o on atr.object_type_id = o.object_type_id
where bl_auth_id in (select bl_auth_id from bl_auth where name like '%Delete%')
and (log_date > to_date('2017-05-28 11:52:00','YYYY-MM-DD HH24:MI:SS')
and
log_date < to_date('2018-05-28 11:52:00','YYYY-MM-DD HH24:MI:SS')
);
SQLServer
select atr.audit_trail_log_id,convert(datetime,atr.log_date,120),atr.role_name,atr.user_name,atr.object_name,o.name,atr.message from audit_trail atr
join object_type o on atr.object_type_id = o.object_type_id
where bl_auth_id in (select bl_auth_id from bl_auth where name like '%Delete%')
and (log_date > convert(datetime,'2017-05-28 11:52:00',120)
and
log_date < convert(datetime,'2018-05-28 11:52:00',120)
);
NOTE:
- Please modify the date range as highlighted in SQL Statements above to get particular time range data else it may not show any data in output