Information needed on how to get details regarding deleted ECN

[MW_13472458]

I am using Windchill PDMLink Release 12.1 and Datecode with CPS 12.1.2.9

Hello Team ,
One ECN has been deleted by mistake. We need to understand who and when it got deleted. The delete event is not enabled in Audit logs. So this information cannot be collected with this report. Could you please let us know if there is any other way to get this information.

[avillanueva]

I just did one today but it is extremely rare. I would say without audit logs, the webserver logs would be the only place except I looked for the event I just did today and it was not really helpful. If you have a database backup, you can look for the IDs of the object that was deleted (IDA2A2 fields and branch IDs). You can then look for URL access to that object if they did the delete from the details page, it should be preceded by an access to that object. the only thing I saw was this confirmation message:

Windchill/netmarkets/jsp/util/getBundleKey.jsp?key=com.ptc.core.ui.confirmationMessagesRB.DELETE HTTP/1.1" 200 41 4061

but it did have my ID next to it.  

Strongly recommend you deny rights on change object deletion for any user that has rights to modify them except for a single admin user. This prevents accidental deletion of records. 

[MW_13472458]

Thank you for this suggestion. This was a good method to find who deleted an object. But unfortunately this did not work in our case as it seems like user did not access the ECN and deleted it , instead from container directly. Because we could not find delete info in web server logs after accessing this object. 

Could you please let us know if there is any other way to get the information.

[cgautier]

Hello MW_13472458,
Delete from context will generate CONFIRM_DELETE_WITH_NUM and delete.jsp outputs in web server log.
Would this help?

Charles.