How do we recover our audit log records from a back-up and insert them into the current audit log tables?

How do we recover our accidentally deleted audit log records and insert them into the current audit log records?

The audit log records are stored in tables RSAS015 and RSAS031. Retrieve your back-up copy of those two tables that contains the records that were accidentally deleted, so you can insert them into the current RSAS015 and RSAS031 table records. You will need to use an insert statement to do this, so you should rely on someone at your company that is familiar with writing SQL insert statements.

One thing to be aware of is the RSA Event ID on some of the archived records may have gotten reused, therefore you might get some duplicates because this is the primary key of both tables.  You should check the Event IDs in both the back-up and the existing tables and make adjustments accordingly.

Other than writing the insert statement and checking for duplicates, there should be no other steps necessary to integrate the records. You should not get prompted with e-signs or approvals, or anything set up in Auditor by inserting the records on the back-end.

Related Content