May 11, 2005 at 11:28 am
Hi All,
In order to see who dropped a couple of tables in one of our databases, I used dbcc log(dbname,3) and captured a lot of information. There are a few records which seem to be the ones I am looking for. Here is one of them,
Current LSN Operation Context Transaction ID Tag Bits Log Record Length Previous LSN Flag Bits Server UID UID SPID Beginlog Status Begin Time Transaction Name Description
---------------------- ------------------------- ------------------------- -------------- -------- ----------------- ---------------------- --------- ----------- ----------- ----------- --------------- ----------------------- -------------------- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
000106b6:00000192:0001 LOP_BEGIN_XACT LCX_NULL 0000:003faed1 0x0000 68 00000000:00000000:0000 0x0200 0 13 65 0x01000000 2005/05/10 11:23:12:020 D R O P O B J DROPOBJ
My question is, from the above record, The server UID shows 0, UID shows 13 and SPID shows 65. Can I draw following conclusions?
1. User is an NT login
2. User is the one in sysusers with UID of 13
Thanks.
Also I would like to know if it is possible to use DBCC Log to read log backup...
Brian
May 12, 2005 at 3:05 am
You know, that you're here in the realm of undocumented features? As far as I can tell, you're better off using an available product on the market for reading the logs.
DROPOBJ is a very strange name for a production table. AFAIK, the structure of the log is available for licensing when you plan to write a log-reading application.
As for your second question: AFAIK, no.
--
Frank Kalis
Microsoft SQL Server MVP
Webmaster: http://www.insidesql.org/blogs
My blog: http://www.insidesql.org/blogs/frankkalis/[/url]
Viewing 2 posts - 1 through 1 (of 1 total)
You must be logged in to reply to this topic. Login to reply