May 11, 2005 at 11:17 am
Hi All,
In order to see who dropped a couple of tables in one of our databases, I used dbcc log(dbname,3) and captured a lot of information. There are a few records returned seem to be the ones I am looking for. The one returned says DROPOBJ, here is one of them,
Current LSN Operation Context Transaction ID Tag Bits Log Record Length Previous LSN Flag Bits Server UID UID SPID Beginlog Status Begin Time Transaction Name Description
---------------------- ------------------------- ------------------------- -------------- -------- ----------------- ---------------------- --------- ----------- ----------- ----------- --------------- ----------------------- -------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
000106b6:00000192:0001 LOP_BEGIN_XACT LCX_NULL 0000:003faed1 0x0000 68 00000000:00000000:0000 0x0200 0 13 65 0x01000000 2005/05/10 11:23:12:020 D R O P O B J DROPOBJ
My question is, from the above record, The server UID shows 0, UID shows 13 and SPID shows 65. Can I draw following conclusions?
1. User is an NT login
2. User is the one in sysusers with UID of 13
Thanks.
Also I would like to know if it is possible to use DBCC Log to read log backup...
Brian
May 12, 2005 at 3:28 am
Please refrain from posting the same question to multiple fora here.
http://www.sqlservercentral.com/forums/shwmessage.aspx?forumid=5&messageid=181560
--
Frank Kalis
Microsoft SQL Server MVP
Webmaster: http://www.insidesql.org/blogs
My blog: http://www.insidesql.org/blogs/frankkalis/[/url]
Viewing 2 posts - 1 through 1 (of 1 total)
You must be logged in to reply to this topic. Login to reply