October 16, 2009 at 12:08 pm
Some records got deleted yesterday. I looked in the default trace but don't see much useful in there. If I restore the database to Database_20091015, and the transaction logs, is there a way to capture the delete statement & who did it ? I don't know the time of day it happened, but I have t-log backups every 1/2 hour.
October 16, 2009 at 12:11 pm
Get a copy of ApexSQL's log parser (www.ApexSQL.com) and it can look for the deletion in the log backups for you. If you're on Full recovery, the delete will be in there.
- Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
Property of The Thread
"Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon
October 16, 2009 at 3:19 pm
Would this work :
I set on a trace on the database, then do a restore and go past the delete step. Would the trace show the deletes ?? Would it show the original process that deleted, or would the account running the restore show as the user deleting the records ?
October 16, 2009 at 3:52 pm
the default trace only shows DDL statements...create table/proc/alter/drop, for example.
you need a separate trace running for DML statments like select/insert/update/delete.
log reader like apex is the way to go here.
Lowell
October 16, 2009 at 10:02 pm
Will ApexSQL Log Reader work with RedGate backups ? I installed it, and got to the point of entering backup file names but got an error "sys.sysrowsets table could not be located" .... oh well, it's late now.
October 17, 2009 at 12:17 am
is that so?
well, thanks for that...
at least i have idea why is it occurring sometimes on our system that there are re cords missing where in fact, no one's deleting it.
Viewing 6 posts - 1 through 5 (of 5 total)
You must be logged in to reply to this topic. Login to reply