May 6, 2014 at 4:53 pm
Hi! This is my first post here, but I'm a longtime reader.
I'm investigating who or what is deleting records from a table. I've used some scripts to query the TLogs to find the login that executed the delete statements. I found that it is our general purpose login that we let applications connect with. So we have several possible culprits, all using the same login.
Is there a way to find out:
1. What specific application using the general purpose login ran the deletes?
2. What specific data was deleted?
Thanks in advance!
May 7, 2014 at 1:54 am
You can use a delete trigger, output the deleted into a table. Easy to use any of the security functions (CURRENT_USER, ORIGINAL_LOGIN(), SESSION_USER, USER, USER_NAME(), SYSTEM_USER) as a column default in the log table.
😎
May 7, 2014 at 2:11 am
Try to create a DDL trigger for the same.
Follw below link.
--rhythmk
------------------------------------------------------------------
To post your question use below link
https://www.sqlservercentral.com/articles/forum-etiquette-how-to-post-datacode-on-a-forum-to-get-the-best-help
🙂
May 7, 2014 at 11:59 am
Thank you...we got it working.
May 7, 2014 at 12:35 pm
daniel.harper (5/7/2014)
Thank you...we got it working.
Can you share your solution so that others may benefit from your hard work? People will find this thread in the future and will be very grateful to find a solution along with the question. 😉
_______________________________________________________________
Need help? Help us help you.
Read the article at http://www.sqlservercentral.com/articles/Best+Practices/61537/ for best practices on asking questions.
Need to split a string? Try Jeff Modens splitter http://www.sqlservercentral.com/articles/Tally+Table/72993/.
Cross Tabs and Pivots, Part 1 – Converting Rows to Columns - http://www.sqlservercentral.com/articles/T-SQL/63681/
Cross Tabs and Pivots, Part 2 - Dynamic Cross Tabs - http://www.sqlservercentral.com/articles/Crosstab/65048/
Understanding and Using APPLY (Part 1) - http://www.sqlservercentral.com/articles/APPLY/69953/
Understanding and Using APPLY (Part 2) - http://www.sqlservercentral.com/articles/APPLY/69954/
June 26, 2014 at 10:55 am
I would be interested in seeing the solution.
Wouldn't "SELECT CURRENT_USER, ORIGINAL_LOGIN(), SESSION_USER, USER, USER_NAME(), SYSTEM_USER" return the general user account ? If this is a scheduled job created long ago, who would be the original login ? Just curious.
----------------------------------------------------
Viewing 6 posts - 1 through 5 (of 5 total)
You must be logged in to reply to this topic. Login to reply