Wednesday, June 3, 2026

States message query show blank result for audit detail query

By seeing status message all the status message is getting generated except audit message. To deep drive issue we have perform below steps to come to root cause and solutions.

Point 1: We have open all the status message and try to delete any package and monitor status found there no logs are generated.

Point 2: We have try to see in table that is there any message has been arrived on database by executing below query but no result has been display.

Select * from vStatusMessagesWithStrings where MessageType = ‘768’

select * from vStatusMessagesWithStrings

where component = ‘Microsoft.ConfigurationManagement.exe’ and MessageID = 30015

 Below are the status message for each recourse for each point:

  • Boundaries Created, Modified, or Deleted – Audit status messages that track the creation, modification, and deletion of boundaries.

    MessageID >= 40600 and MessageID <= 40602

  • Client Component Configuration Changes – Audit status messages that track changes to the client components” configuration kept in the site control file.

    MessageID >= 30042 and MessageID <= 30047

  • Collection Member Resources Manually Deleted – Audit status messages that track the manual deletion of collection member resources by an administrator.

    MessageID >= 30066 and MessageID <= 30067

  • Collections Created, Modified, or Deleted – Audit status messages that track the creation, modification, and deletion of collections.

    MessageType = 768 and MessageID >= 30015

  • Deployments Created, Modified, or Deleted – Audit status messages that track the creation, modification, and deletion of deployments.

    MessageID >= 30006 and MessageID <= 30008

  • Packages Created, Modified, or Deleted – Audit status messages that track the creation, modification, and deletion of packages.

    MessageID >= 30000 and MessageID <= 30002

  • Programs Created, Modified, or Deleted – Audit status messages that track the creation, modification, and deletion of package programs.

    MessageID >= 30003 and MessageID <= 30005

  • Queries Created, Modified, or Deleted – Audit status messages that track the creation, modification, and deletion of queries, including status message queries.

    MessageID >= 30063 and MessageID <= 30065

  • Remote Control Activity Initiated at a Specific Site – Audit status messages that track the use of the Remote Control.

    MessageID >= 30069 and MessageID <= 30087

  • Security Roles / Scopes created, modified, or deleted – Audit status messages that track the creation, modification, and deletion of security rights.

    (stat.MessageID >= 31200 and stat.MessageID <= 31202 OR stat.MessageID >= 31220 and stat.MessageID <= 31222 OR stat.MessageID = 31207)

  • Server Component Configuration Changes – Audit status messages that track changes to the server components” configuration kept in the site control file.

    (MessageID >= 30033 and MessageID <= 30035) or (MessageID >= 30039 and MessageID <= 30041)

  • Site Addresses Created, Modified, or Deleted – Audit status messages that track the creation, modification, and deletion of site addresses.

    MessageID >= 30018 and MessageID <= 30020

By seeing above message message particular table is missing on database so suggested to perform:-

Point 1: If you have any new sccm upgrade plan then it will fix issue.

Point 2: if you dont have any upgrade plan then i would suggest you to run site maintenance and rest component.

Happy Learning!!!

Thanks & Regards
Solution Teams
Email: [email protected], [email protected]
Facebook https://www.facebook.com/Hiraniconfigmgr-120189361980772/
Follow me: https://www.linkedin.com/in/hiraniconfigmgr

Author

  • Hi, I’m Haresh Hirani the mind behind Hiraniconfigmgr.com. I’m a seasoned IT professional with deep expertise in Microsoft technologies, especially in Configuration Manager (ConfigMgr/SCCM). Over the years, I’ve expanded my skill set to cover a broader range of modern device management platforms like Microsoft Intune, Jamf Pro, ManageEngine Endpoint Central, and VMware AirWatch (Workspace ONE UEM), I use this blog to document real-world, tested, working fixes and walkthroughs from my daily technical experiences. The 💡idea is simple: if it helped me, it might help someone like you. My goal is to create a living repository of practical IT solutions for the community. If you find something useful, or if you want to collaborate, feel free to connect with me on LinkedIn or drop a message through the Contact page. Happy to help.

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest posts