Monitoring deleted documents

Run the Compact task with the -dl argument to enable logging of data about deleted documents in databases that you specify. The data is logged to entries in deletion log files that are added to the IBM_TECHNICAL_SUPPORT directory on a server. For example, you can log when documents are deleted from mail files to help troubleshoot if users report missing documents.

Procedure

  1. Ensure that transaction logging is enabled for the databases.
  2. Run Compact as follows on the server: 
    load compact <database path> -dl on "<comma separated list of items>"

    where <database path> is a specific database or a directory of databases, relative to the data directory, for example, mail or discussion.nsf.

    <comma separated list of items> is a list of fields to show in the logs to help you identify deleted documents. The fields must be one of these types: Text, Text_List, RFC822_Text, or Time.

Results

When documents are deleted from a database, entries are added to the current deletion log file, delete.log.

When the server is restarted, a new deletion log file is created. Old deletion log files are renamed to delete_<servername>_yyyy_mm_dd@hh_mm_ss.log; for example: delete_Server1\Renovations_2018_12_15@06_28_45.log

Deleting a document from a database adds an entry to the current deletion log file with the following data. This data is provided in a CSV-compatible format.
Data in deletion log entry More information
Date and time of the document deletion
Database from which the document was deleted. Relative to the data directory
Replica ID of the database Helps you find multiple replicas of a database in the log if the database name is not the same on all servers.
Process that did the deletion
For example:
  • server
  • dbmt
  • replica
Name of the server or person who deleted the document
Type of document deletion

Can be:

SOFT -- document is in the trash

HARD -- Stub delete (for example when the document is deleted from the trash)

RESTORE (document restored after a SOFT delete)
Class of document deleted Specified as one of the following hex values:
  • 0001 (Document - NOTE_CLASS_DATA)
  • 0002 (About Database Document - NOTE_CLASS_INFO)
  • 0004 (Form - NOTE_CLASS_FORM)
UNID Unique document identifier across replicas
Items Up to four field values in a deleted document to help you identify it. Specified when you enable deletion logging. Although you can specify more than four field values, only the first four that are found are shown in the log entry. Each item has three parts: the item name, the length of the item value, and the first 400 characters of the item value.
Note:
It's possible for a document deletion not to be carried out as a result of a failure of some sort. In this case, an UNDO entry is shown in the deletion log with an UNDO flag and the following data:
  • Date and time of the document deletion
  • Database from which document was deleted
  • Replica ID of database
  • UNDO flag
  • Type of delete that was undone
  • UNID for the document

Example

Here is an example of a deletion entry in a deletion log file: 
delete_Fender_2018_08_07@11_10_27.log
"20180807T111203,97-04","mail3\ablakely.nsf","85258272:004AC676","nserver","CN=Autumn Blakely/O=Guitars","SOFT","0001","12ECB1FC:9E6B6C92852582C7:003F4DC6","SendTo","33","CN=Autumn Blakely/O=Guitars@Music","From","26","CN=Aaliyah Click/O=Guitars","DeliveredDate","22","07/11/2018 07:31:35 AM"
"20180807T111547,33-04","mail3\ablakely.nsf","85258272:004AC676","nserver","CN=Autumn Blakely/O=Guitars","SOFT","0001","AF7A32D0:A1D341FB852582C7:0041E265","SendTo","33","CN=Autumn Blakely/O=Guitars@Music","From","26","CN=Autumn Blakely/O=Guitars","DeliveredDate","22","07/10/2018 08:43:04 AM"
"20180807T111548,29-04","mail3\ablakely.nsf","85258272:004AC676","nserver","CN=Autumn Blakely/O=Guitars","SOFT","0001","B59627D6:B03715C9852582C7:0041E29E","SendTo","33","CN=Autumn Blakely/O=Guitars@Music","From","26","CN=Aaliyah Click/O=Guitars","DeliveredDate","22","07/10/2018 08:44:55 AM"
"20180807T111548,31-04","mail3\ablakely.nsf","85258272:004AC676","nserver","CN=Autumn Blakely/O=Guitars","SOFT","0001","8F6434B4:B12D47FD852582C7:006E37BF","SendTo","33","CN=Autumn Blakely/O=Guitars@Music","From","26","CN=Aaliyah Click/O=Guitars","DeliveredDate","22","07/11/2018 04:05:05 PM"
"20180807T111605,08-04","mail3\ablakely.nsf","85258272:004AC676","nserver","CN=Autumn Blakely/O=Guitars","HARD","0001","12ECB1FC:9E6B6C92852582C7:003F4DC6","SendTo","33","CN=Autumn Blakely/O=Guitars@Music","From","26","CN=Aaliyah Click/O=Guitars","DeliveredDate","22","07/11/2018 07:31:35 AM"
"20180807T111605,08-04","mail3\ablakely.nsf","85258272:004AC676","nserver","CN=Autumn Blakely/O=Guitars","HARD","0001","D2E87AED:C862ACAA852582C7:0041E276","SendTo","33","CN=Autumn Blakely/O=Guitars@Music","From","26","CN=Autumn Blakely/O=Guitars","DeliveredDate","22","07/10/2018 08:43:04 AM"
The following table explains the content in the example entry:
Table 1. Explanation of content in the example deletion log entry
Data in deletion log entry Example output
Date and time of the document deletion "20180807T111203,97-04"
Database from which the document was deleted "mail3\ablakely.nsf"
Replica ID of the database "85258272:004AC676"
Process that did the deletion "nserver"
Name of the server or person who deleted the document  "CN=Autumn Blakely/O=Guitars"
Type of document deletion "SOFT"
Class of document deleted "0001"
UNID "12ECB1FC:9E6B6C92852582C7:003F4DC6"
Item 1 Field name "SendTo"
Item 1 Value length "33"
Item 1 Value "CN=Autumn Blakely/O=Guitars@Music"
Item 2 Field name "From"
Item 2 Value length "26"
Item 2 Value "CN=Aaliyah Click/O=Guitars"
Item 3 Field Name "DeliveredDate"
Item 3 Value length "22"
Item 3 Value "07/11/2018 07:31:35 AM"