SNTT: Track who is deleting documents
Friday 13th July, 2007The question will eventually come up, who deleted this document from the database. Well, if you are familiar with deletion stubs and tracking the Universal ID from the document to the deletion stub, you know that you are only able to determine when a document was deleted and not who. Multiple times now I had reports from customers that "Domino is deleting my email again". After troubleshooting and monitoring it has always been discovered that the Administrative Assistant was cleaning up the Executive's mail file, the messages were actually deleted from a hand held device be they were told by someone that deletions from a handheld don't replicate back to the mail file or someone just cleaning out their mail file and using the All Documents view just didn't realize they were deleting "All" the documents.
To help with troubleshooting this, I created a LotusScript that can be placed in the QueryDocumentDelete Event of the DatabaseScript and it will create a document in the user's mail file and save the UID, time it was deleted and the person's name who hit the delete key.
You can then create a view in user's mail file to show all documents where Form = "WhoDoneIt" and then add three columns, "CreationDate", "UIDofDoc", & "thisperson" (based on the fields names used in the Script). The view will allow you to quickly find the UID and who deleted it. A few call outs. If Soft Deletions are enabled, it records when the document was marked for deletion by the end user, not when it was purged from the database. If a user undeletes something, we would find a second entry when they marked it for deletion a second time. If Soft Deletions are disabled, it records when the document was marked for deletion and the "X" was placed beside the document, not when the user actually hit "F9" and permanently deleted the document. In this scenario, you can hit delete and place the "X" beside the document, press delete again and remove the "X". Every time you press delete and place the "X" beside the document, the script will record that event each time.
Just be sure to remove the LotusScript and clean out the documents it created after you finish troubleshooting and determining who is deleting the documents (or convincing the end user they were deleting their own documents the whole time).
Dim session As New notessession
Dim deletiontrackingdoc As notesdocument
Dim dtrtitem As notesrichtextitem
Set collection = source.documents
Set note = collection.GetFirstDocument
Set dbmail = session.currentdatabase
While Not(note Is Nothing)
Set deletiontrackingdoc = dbmail.createdocument
deletiontrackingdoc.form = "WhoDoneIt"
deletiontrackingdoc.UIDofDoc = note.universalID
deletiontrackingdoc.thisperson = session.UserName
Set dtrtitem = New notesrichtextitem(deletiontrackingdoc, "Body")
dtrtitem.appendtext ("Deletion tracking was recorded for document UNID " & note.universalID)
dtrtitem.addnewline(1)
dtrtitem.appendtext("Deletion was caused by " & session.UserName)
Call deletiontrackingdoc.save(True,True,True)
Set note = collection.getnextdocument(note)
Wend
To help with troubleshooting this, I created a LotusScript that can be placed in the QueryDocumentDelete Event of the DatabaseScript and it will create a document in the user's mail file and save the UID, time it was deleted and the person's name who hit the delete key.
You can then create a view in user's mail file to show all documents where Form = "WhoDoneIt" and then add three columns, "CreationDate", "UIDofDoc", & "thisperson" (based on the fields names used in the Script). The view will allow you to quickly find the UID and who deleted it. A few call outs. If Soft Deletions are enabled, it records when the document was marked for deletion by the end user, not when it was purged from the database. If a user undeletes something, we would find a second entry when they marked it for deletion a second time. If Soft Deletions are disabled, it records when the document was marked for deletion and the "X" was placed beside the document, not when the user actually hit "F9" and permanently deleted the document. In this scenario, you can hit delete and place the "X" beside the document, press delete again and remove the "X". Every time you press delete and place the "X" beside the document, the script will record that event each time.
Just be sure to remove the LotusScript and clean out the documents it created after you finish troubleshooting and determining who is deleting the documents (or convincing the end user they were deleting their own documents the whole time).
Dim session As New notessession
Dim deletiontrackingdoc As notesdocument
Dim dtrtitem As notesrichtextitem
Set collection = source.documents
Set note = collection.GetFirstDocument
Set dbmail = session.currentdatabase
While Not(note Is Nothing)
Set deletiontrackingdoc = dbmail.createdocument
deletiontrackingdoc.form = "WhoDoneIt"
deletiontrackingdoc.UIDofDoc = note.universalID
deletiontrackingdoc.thisperson = session.UserName
Set dtrtitem = New notesrichtextitem(deletiontrackingdoc, "Body")
dtrtitem.appendtext ("Deletion tracking was recorded for document UNID " & note.universalID)
dtrtitem.addnewline(1)
dtrtitem.appendtext("Deletion was caused by " & session.UserName)
Call deletiontrackingdoc.save(True,True,True)
Set note = collection.getnextdocument(note)
Wend
[3]