Frequently, we hear from healthworkers that they are not able to find some households, or some person or some records that they collected previously. Since those documents were not configured for purging, upon checking it was found that those documents are in tombstone, which means they were deleted.
Is there a way to know when and which user deleted a particular document?
Iām afraid there is no direct or easy way to trace this information.
The best place to check is the haproxy log, which should serve as an audit log. However, this log has one limitation where it might not log the full request body, especially if the body is very long, so you might not find which request triggered the delete.