I don’t know of a way to tell in FOG. FOG doesn’t log those actions and associated information itself. I’m not much on mysql transaction log inspection either. You might be able to grep the apache logs and look for a delete or “rmhostid=” string.