Post reply

Who changed the recovery model?

  • January 17, 2013 at 3:39 am

    #272903

    Hi All

    I'm trying to establish who changed the recovery model. I've tried default trace, Sp_readerrorlog 0, 1, 'recovery', the logs etc but not really finding much joy in actually finding the event and then who.

    Does anyone have anything that may help?

    Thanks in advance!

    Martyn

  • January 17, 2013 at 3:53 am

    #1578210

    The log will show the spid and timestamp that the recovery model changed.

    You can then correllate that back to the default trace, as long as the data is still in the default trace.

    Other than that you will need to setup custom auditing, via a DDL trigger, extended events etc which trap the ALTER DATABASE command

  • January 17, 2013 at 10:32 am

    #1578417

    Thank you for you reply. I've had a good stab at it and eventually found the info needed within the windows server log. Thanks though.

Viewing 3 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic. Login to reply