Last friday, we discovered that some records have been deleted in several
tables of our SQL server 2000.
Please could you tell what to do in order to find the origin of the delete (
name of workstation or ip adress).
Cette action est irreversible, confirmez la suppression du commentaire ?
Signaler le commentaire
Veuillez sélectionner un problème
Nudité
Violence
Harcèlement
Fraude
Vente illégale
Discours haineux
Terrorisme
Autre
Fabian SIRACH [MS]
Hi,
The only way to find who executed deleted queries against your database is to *previoulsy* have launched a SQL Profiler in order to capture SQL Server Activity on your server, including login/logout objects et T-SQL Statements and appropriate columns. If you haven't lauched a such process you cannot have informations on who deleted your records. If you want to recover, you have to restore the database to a safe point. You might use external tools such as LogExplorer from http://www.lumigent.com/ to audit further deletion and recover deleted rows from the log using this tool - should be installed before the problem occured - (You can also restore the SQL log at a point in time if you have informations on date/time deletion, after lauching a SQL Profile Trace)
Regards,
Fabian
"SR" wrote in message news:
Hi,
Last friday, we discovered that some records have been deleted in several tables of our SQL server 2000. Please could you tell what to do in order to find the origin of the delete ( name of workstation or ip adress).
Thanks in advance for you quick answer.
Hi,
The only way to find who executed deleted queries against your database is
to *previoulsy* have launched a SQL Profiler in order to capture SQL Server
Activity on your server, including login/logout objects et T-SQL Statements
and appropriate columns. If you haven't lauched a such process you cannot
have informations on who deleted your records.
If you want to recover, you have to restore the database to a safe point.
You might use external tools such as LogExplorer from
http://www.lumigent.com/ to audit further deletion and recover deleted rows
from the log using this tool - should be installed before the problem
occured - (You can also restore the SQL log at a point in time if you have
informations on date/time deletion, after lauching a SQL Profile Trace)
Regards,
Fabian
"SR" <SR@discussions.microsoft.com> wrote in message
news:CFC1F39E-ECE2-4275-B36B-EBCC9709E956@microsoft.com...
Hi,
Last friday, we discovered that some records have been deleted in several
tables of our SQL server 2000.
Please could you tell what to do in order to find the origin of the delete
(
name of workstation or ip adress).
The only way to find who executed deleted queries against your database is to *previoulsy* have launched a SQL Profiler in order to capture SQL Server Activity on your server, including login/logout objects et T-SQL Statements and appropriate columns. If you haven't lauched a such process you cannot have informations on who deleted your records. If you want to recover, you have to restore the database to a safe point. You might use external tools such as LogExplorer from http://www.lumigent.com/ to audit further deletion and recover deleted rows from the log using this tool - should be installed before the problem occured - (You can also restore the SQL log at a point in time if you have informations on date/time deletion, after lauching a SQL Profile Trace)
Regards,
Fabian
"SR" wrote in message news:
Hi,
Last friday, we discovered that some records have been deleted in several tables of our SQL server 2000. Please could you tell what to do in order to find the origin of the delete ( name of workstation or ip adress).
