Attachment Logging/Auditing - Where did that attachment go?

[MB26]

I was asked the other day if ServiceNow has any attachment auditing in place to see when an attachment was added or removed from a record. I was not aware of any, so I came up with the following. Maybe this can help someone else.

When you attach something to a record, it creates an entry in the "sys_attachment" table. When it is removed from the record it deletes the record from this same table. So I created two different business rules to make a log in the record of what is added/removed. When an attachment is inserted/deleted it will place a work note in the record that the attachment has been attached or removed. Since this is logged into the work notes field, it will also keep track of who did it and when in the activity section. There is a limitation to this in that if you attach something to a record prior to the record being created, you will not get an update in the record because one does not exist yet in the DB. So keep that in mind.

Also, if you want to limit this to making update on only certain tables you can utilize the condition field in the Business Rule like this.

current.table_name == "incident"

Merely change the "incident" to the table name you want it to update on.

1. Create a Business Rule on the "sys_attachment" table. This will log a work note in the record that it was attached.
-Name: "Insert Attachment - Update Record"
-When: After
-Insert: true

updateRecordForAttachment();
function updateRecordForAttachment(){
 var gr = new GlideRecord(current.table_name);
   if(gr.get(current.table_sys_id)){
  gr.work_notes = "Attachment: " + current.file_name + " has been attached.";
  gr.update();
   }
}

2. Create a Business Rule on the "sys_attachment" table. This will log a work note in the record that it was removed.
-Name: "Delete Attachment - Update Record"
-When: Before
-Delete: true

updateRecordForAttachment();
function updateRecordForAttachment(){
 var gr = new GlideRecord(current.table_name);
   if(gr.get(current.table_sys_id)){
  gr.work_notes = "Attachment: " + current.file_name + " has been removed.";
  gr.update();
   }
}

The Activity section on the record would then look this