Action Center Audit logs shows System Admin deletes Items

Help Action Center
1

We are working with Action center, an RPA bot adds action center forms and users submits it. We noticed in the audit logs

audit ss
audit ss1657×729 105 KB

System Administrator account does delete something and it is always twice in succession. We have no idea who does it from our end and/or what was deleted. Does anyone have an Idea? or maybe point us on how to investigate further

2

@Ezekiel_Gomez1

Please check the retention policy, it is possible that it may be deleted automatically due to retention policy.

Delete by System Admin mainly shows when it’s deleted automatically as a part of retention policy or similar.

Also, check if there’s any RPA workflow associated with the submit button or action.

3

Hi @Ezekiel_Gomez1
some action records or temporary form data are automatically cleaned by system background services. In UiPath Orchestrator audit logs this operation appears under System Administrator even though no user triggered it. It may appear twice because both the action record and its related metadata are removed. To investigate, check Orchestrator audit logs for entity type Action or ActionData and review robot logs at the same timestamp.

For more:

If helpful, mark as solution. Happy automation with UiPath