Solved

SQL Server logs - how to find out what happened and when

Posted on 2011-09-05
7
273 Views
Last Modified: 2012-08-14
Hi,

One of our production databases has been altered over the weekend. In particular a table containing user data has been updated across the board, altering usernames. This should not have happened and we are trying to find out when it happened and who did it.

Our regular DBA is not here and although I do SQL Server DB development I'm not sure what can be done in this situation. It seems like the database and transaction logs have only been retained for the past two days so the oldest available backup includes the unwanted changes committed.

Is there any way to find out when these updates occurred and under what credentials this happened?

Thanks.
0
Comment
Question by:irb56
7 Comments
 
LVL 15

Expert Comment

by:gplana
ID: 36483312
Do you mean error logs ?

Please see this link: http://msdn.microsoft.com/en-us/library/ms187885.aspx
0
 

Author Comment

by:irb56
ID: 36483350
Thanks for the link but these are not errors we're trying to identify, they are committed update transactions on a particular table. I've done a bit of searching, which so far has lead me to download a trial of a log reader named ApexSQL Log. I believe this is supposed to allow you to audit database changes, including seeing details of the transaction(s) that updated the table in question and the associated login info, etc.

However, I am unsure what the limitations of such a tool will be. How far back can you go in the auditing?
0
 
LVL 15

Accepted Solution

by:
gplana earned 500 total points
ID: 36483422
It depends of your logs. You can go until last checkpoint, which is a point where logs are synchronized with data. For example, in Oracle there is a mode called "archive logs" which permits to have all logs archieved, so you can go virtually to any passed time.

I don't think SQL-server has this functionality, but you can use DTS. See this: article: technet.microsoft.com/en-us/library/bb687457.aspx
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 

Author Comment

by:irb56
ID: 36483426
It looks like the ApexSQL Log tool is excellent. As well as identifying the details of every change, it provides a facility for automatically generating scripts to reverse the change.

I assume there are other SQL Server log reader tools out there. Does anyone have any recommendations, particularly if there are any useful products that don't cost as much as ApexSQL?

Also I am curious regarding the limits of a log reader tool. How is it affected by the database recovery model and the frequency and types of backup? For example, if a database has the full recovery model and both database and log file gets backed up, doesn't this truncate the log file and would this mean that those transactions truncated from the log file would then become unavailable to the SQL log reader tool?
0
 
LVL 10

Expert Comment

by:sqlservr
ID: 36487736
use xp_readerrorlog command in the management studio, you will get the error log
0
 
LVL 75

Expert Comment

by:Anthony Perkins
ID: 36488139
>>use xp_readerrorlog command in the management studio, you will get the error log<<
Pray tell what in the world has that got to do with the Transaction Log?
 
0
 

Author Closing Comment

by:irb56
ID: 36528012
Thanks for your help. :-)
0

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
SQL Server Count where two id types exist in column 8 29
SQL trigger 5 21
TSQL convert date to string 4 34
Substring works but need to tweak it 14 13
There have been several questions about Large Transaction Log Files in SQL Server 2008, and how to get rid of them when disk space has become critical. This article will explain how to disable full recovery and implement simple recovery that carries…
In this article I will describe the Detach & Attach method as one possible migration process and I will add the extra tasks needed for an upgrade when and where is applied so it will cover all.
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question