Overview

A group or space appears to have been deleted from Jive. How can you find out who deleted this group and when they deleted it?

This article describes how to find the most recent actions taken on a group or space, and which user took those actions.

Solution

<supportagent>

Support agents:

1. Navigate to the customer's instance in the Jive Cloud Admin.
2. Click on the Magic Query Tool for their instance.
3. Select the "Email results" checkbox.
4. Use the queries listed below based on the information the customer provided.

</supportagent>

Jive Cloud or Hosted

Please contact us so that ATLAS can assist you. If you are not satisfied with the solution provided by ATLAS, then it will create a ticket for you on which you can provide the name of the place that was deleted and any additional information about when you suspect the deletion took place.

Jive On-Premise

If you know the exact name of the group or space that was deleted, please use this query, replacing <placename> with the name of the group or space:

SELECT jiveuser.userid, jiveuser.firstname, jiveuser.lastname, description, 
TO_CHAR(TO_TIMESTAMP(timestamp / 1000), 'DD/MM/YYYY HH24:MI:SS') AS date 
FROM jiveauditlog LEFT JOIN jiveuser ON jiveauditlog.userid = jiveuser.userid
WHERE description LIKE '%<placename>%' 
ORDER BY auditmessageid DESC
LIMIT 500

If you don't know the exact name of the group or space, please use this query, then filter through the results for the specific record that matches the name:

SELECT jiveuser.userid, jiveuser.firstname, jiveuser.lastname, description, 
TO_CHAR(TO_TIMESTAMP(timestamp / 1000), 'DD/MM/YYYY HH24:MI:SS') AS date 
FROM jiveauditlog LEFT JOIN jiveuser ON jiveauditlog.userid = jiveuser.userid
WHERE description LIKE 'Deleting blog%' 
ORDER BY auditmessageid DESC
LIMIT 500

Please note: The reason that the above query references "Deleting blog" in the description is that each group or space in Jive has a blog associated with it, and blog deletion is more readily identifiable in the audit log.