Post reply

Reading a tran log backup

  • October 24, 2007 at 6:11 pm

    #199348

    Someone deleted several tables in a production database today.

    I was able to do a point in time recovery to get back almost all of my data.

    I want to review the tran log to see who did the drop of the tables

    Anyone have anyway or know of any tools to do this???

    Thanks in Advance

    Eric Peterson

  • October 25, 2007 at 2:27 am

    #745264

    There are several third-paerty tools available for this but. Try Lumigent LogExplorer , Red-Gate Log Rescue or ApexSqlLog. Not sure about all of them, but I think you can downoad a fully functional trial version for free.

    Markus

    [font="Verdana"]Markus Bohse[/font]

  • October 25, 2007 at 2:39 am

    #745267

    Please note that the transaction log is not an audit log. This means that the user who dropped the table may not be recorded in the transaction log (this is clearly not required for recovery :)). There are various rules about when a user id is recorded, but an example for when it is not recorded, is when someone executes "drop table somedb.someschema.sometable" in a database that is not "somedb". Having said this, a third party tool will be able to show you who this user was if the userid is recorded.

    If this happened very recently, and you have time and patience to read and understand the transaction log, you may want to see what

    dbcc log (databaseid,-1) with tableresults

    returns.

    Regards,

    Andras

    Andras Belokosztolszki, MCPD, PhD
    GoldenGate Software

  • October 25, 2007 at 1:53 pm

    #745477

    I actually had redgate Log Repair in house, and that gave me some good information.

    Note it was a table drop.....a non logged bit of code, so it could only tell me the userid ( it was the application ) who issued the drops.

    Thanks for your help

    Eric Peterson

  • October 25, 2007 at 1:53 pm

    #745478

    I actually had redgate Log Repair in house, and that gave me some good information.

    Note it was a table drop.....a non logged bit of code, so it could only tell me the userid ( it was the application ) who issued the drops.

    Thanks for your help

    Eric Peterson

  • October 25, 2007 at 1:53 pm

    #745479

    I actually had redgate Log Repair in house, and that gave me some good information.

    Note it was a table drop.....a non logged bit of code, so it could only tell me the userid ( it was the application ) who issued the drops.

    Thanks for your help

    Eric Peterson

  • October 26, 2007 at 12:40 am

    #745590

    Your application(s) has DROP TABLE permission???

    Scary.

    [font="Verdana"]Markus Bohse[/font]

Viewing 7 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic. Login to reply