Post reply

Trace IP access

  • January 24, 2006 at 4:58 pm

    #115973

    Dear All,

    Is it possible to trace from which connection( IP address ) a user access MSSQL Database?

    My client suddenly got one of his table deleted, and I want to trace the log, who or from where, the table was deleted.

    Please advise, how to do this

     

    Thank you

     

    Best Regards,

    -Andy J.-

  • January 24, 2006 at 8:19 pm

    #616802

    SQL Server does not store the IP address information nor does it log it through a tool like Profiler.

    If you didn't have Profiler or traces running at the time, You may be able to trace the log file for *who* did it (as in the user account), but it's there's been a compromise, admittedly that won't do you a lot of good.

    Basically you'll need some sort of other logging to have caught this, either packet traces or IDS logs... and IDS logs are only good if they matched a particular signature. Trying to reconstruct IP address after the fact needs this sort of logging.

    K. Brian Kelley
    @kbriankelley

  • February 10, 2006 at 9:09 am

    #620184

    Hi,

    Thanks for the advise. btw, where can I find this tools : profiler ?

    Thanks Again

     

    Regards

  • February 10, 2006 at 12:54 pm

    #620262

    EM-->Tools-->SQL Profiler

     

    Don't ask me what's EM.

  • February 10, 2006 at 5:29 pm

    #620304

    oh, SQL profiler, I tought you are talking about another profiler tools ( 3rd party software ). 

    Thank you

Viewing 5 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply