After adding an attachment to a record, if you View/download the attachment the first time the Updated timestamp on the sys_attachment record is updated. This doesn't happen on subsequent views/downloads of the attachment.

Release or Environment



This is expected behavior. 


As part of the Madrid release a new feature 'Antivirus Scanning' was added, which scans attachments in the instance for any virus definitions.

Doc link: https://docs.servicenow.com/bundle/madrid-platform-administration/page/administer/security/concept/antivirus-protection.html.

A new column 'state' was added to sys_attachment table which indicates if the file is clean/infected.

On state changes, 'updated and updated_by' are modified. This is expected since a field on that table changes.

PRB1343109 fixes change in 'updated and updated_by' fields on parent record.


Since this is expected behavior, our recommendation is to revisit the customized code that may be affected by this functionality.

Additional Information

See KB0751556.

Article Information

Last Updated:2019-09-09 07:51:07