Find who/process that deleted records

  • Is it possible to find who deleted records from a table? The DB is set for Full recovery model. This is on a SQL 2005 Server w/SP2. I don't know if it is a person or a process somewhere. It's not at any predictable time this happens. It's pretty random. As of now, It happened 2 to 6 hrs ago.

    Thanks

  • Retroactively, probably not. There's a very slim chance that you might possibly find a shred of evidence in the transaction logs.

    Proactively:

    set up a Profiler trace or an On Delete trigger (best if there's a specific table in question).

  • Yes, there is. Buy a copy of ApexSQL Log from ApexSQL.com. It is my VERY strong opinion that every production sql server environment should have the functionality this product provides on hand 24/7.

    DISCLAIMER: I have a very close relationship with ApexSQL. I use and recommend their products to my clients. If you care to you can get a discount (and I can get a small remuneration) if you tell them TheSQLGuru sent you.

    Best,
    Kevin G. Boles
    SQL Server Consultant
    SQL MVP 2007-2012
    TheSQLGuru on googles mail service

  • There's a few other log products (Lumigent, LogPI), but Apex is probably the cheapest and will help you find this out if you have the logs or backups.

  • This of course presumes that Windows auth is in place (or something to identify the user), right? won't help much if everyone is logging in under the same account, would it?

    ----------------------------------------------------------------------------------
    Your lack of planning does not constitute an emergency on my part...unless you're my manager...or a director and above...or a really loud-spoken end-user..All right - what was my emergency again?

  • By examining the transaction of concern (and perhaps some of those around it) it could still be possible to determine if it is a process or a person, even if everyone/thing logs in as SA.

    Best,
    Kevin G. Boles
    SQL Server Consultant
    SQL MVP 2007-2012
    TheSQLGuru on googles mail service

Viewing 6 posts - 1 through 5 (of 5 total)

You must be logged in to reply to this topic. Login to reply