Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 
        
Home       Members    Calendar    Who's On


Add to briefcase

how can we know the deleted userinformation on a particular table in DB Expand / Collapse
Author
Message
Posted Monday, September 17, 2012 7:10 AM
SSC Rookie

SSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC Rookie

Group: General Forum Members
Last Login: Thursday, May 16, 2013 7:00 AM
Points: 38, Visits: 249
Hi ,

in last couple of days, one table is truncating means its having zero records init.

it is very useful table to our process. but it is truncating in last couple of days.

my question how can we know the information of a user who truncating the table . may be it is a sqlserver Agent.

Please let me know in case of any additional data required.

Thanks in advance.
Post #1360175
Posted Monday, September 17, 2012 7:16 AM
SSC-Enthusiastic

SSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-Enthusiastic

Group: General Forum Members
Last Login: Tuesday, May 14, 2013 6:33 AM
Points: 162, Visits: 659
The easiest way is to either set up a trigger to log delete actions or to set up SQL PROFILER to capture the activity on this table.

If you had a Forgein Key constarint on the table it wouldn't allow the truncate to run.
Post #1360181
Posted Monday, September 17, 2012 7:21 AM
SSC-Enthusiastic

SSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-EnthusiasticSSC-Enthusiastic

Group: General Forum Members
Last Login: 2 days ago @ 3:07 PM
Points: 138, Visits: 355
Not sure if a delete trigger solves the problem, because TRUNCATE is non-logged. That is why it is so quick, but also why it requires elevated permissions.

Is it truly a truncate or a DELETE *?
Post #1360186
Posted Monday, September 17, 2012 7:27 AM
SSC Rookie

SSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC Rookie

Group: General Forum Members
Last Login: Thursday, May 16, 2013 7:00 AM
Points: 38, Visits: 249
not sure, but it is having only emply data in it.!!!
Post #1360193
Posted Monday, September 17, 2012 7:41 AM
SSC Rookie

SSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC Rookie

Group: General Forum Members
Last Login: Wednesday, April 10, 2013 1:07 PM
Points: 26, Visits: 88
As you say that this data in the table is getting deleted only for the last couple of days,

Kindly check the recently deployed codes (Stored Procedures, Patches) for the week if possible. If truncate is used you cannot do anything. Try to add a constraint to the table or fira trigger ON DELETE for the table. This can help you to find the culprit.
Post #1360203
Posted Monday, September 17, 2012 7:58 AM


SSCrazy Eights

SSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy Eights

Group: General Forum Members
Last Login: 2 days ago @ 8:46 AM
Points: 8,547, Visits: 8,204
tim_harkin (9/17/2012)
Not sure if a delete trigger solves the problem, because TRUNCATE is non-logged. That is why it is so quick, but also why it requires elevated permissions.

Is it truly a truncate or a DELETE *?


To be clear a TRUNCATE IS logged. Every action in sql is logged (ACID). A TRUNCATE logs the pages not the individual rows, that is why it so much faster.


_______________________________________________________________

Need help? Help us help you.

Read the article at http://www.sqlservercentral.com/articles/Best+Practices/61537/ for best practices on asking questions.

Need to split a string? Try Jeff Moden's splitter.

Cross Tabs and Pivots, Part 1 – Converting Rows to Columns
Cross Tabs and Pivots, Part 2 - Dynamic Cross Tabs
Post #1360221
Posted Monday, September 17, 2012 8:03 AM


SSCrazy Eights

SSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy EightsSSCrazy Eights

Group: General Forum Members
Last Login: 2 days ago @ 8:46 AM
Points: 8,547, Visits: 8,204
balajisrm (9/17/2012)
As you say that this data in the table is getting deleted only for the last couple of days,

Kindly check the recently deployed codes (Stored Procedures, Patches) for the week if possible. If truncate is used you cannot do anything. Try to add a constraint to the table or fira trigger ON DELETE for the table. This can help you to find the culprit.


All is not lost if it is a truncate. You can still use DDL triggers to capture the truncate and either prevent it or log it.


_______________________________________________________________

Need help? Help us help you.

Read the article at http://www.sqlservercentral.com/articles/Best+Practices/61537/ for best practices on asking questions.

Need to split a string? Try Jeff Moden's splitter.

Cross Tabs and Pivots, Part 1 – Converting Rows to Columns
Cross Tabs and Pivots, Part 2 - Dynamic Cross Tabs
Post #1360223
Posted Monday, September 17, 2012 8:07 AM


SSC-Insane

SSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-InsaneSSC-Insane

Group: General Forum Members
Last Login: Today @ 4:07 PM
Points: 21,589, Visits: 27,388
As Sean said, TRUNCATE is a logged operation. TRUNCATE, however, does not fire DELETE triggers on tables. If you need to know who is deleting data from the table, you will need to setup a server-side trace or use extended events to capture that information.



Lynn Pettis

For better assistance in answering your questions, click here
For tips to get better help with Performance Problems, click here
For Running Totals and its variations, click here or when working with partitioned tables
For more about Tally Tables, click here
For more about Cross Tabs and Pivots, click here and here
Managing Transaction Logs

SQL Musings from the Desert Fountain Valley SQL (My Mirror Blog)
Post #1360227
Posted Monday, September 17, 2012 8:35 AM
SSC Rookie

SSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC Rookie

Group: General Forum Members
Last Login: Thursday, May 16, 2013 7:00 AM
Points: 38, Visits: 249
Thanks Lynn and to others.

I have been created to Trace file which capture the transacations performed on table by any user...


Thanks again!!!
Post #1360245
Posted Monday, September 17, 2012 8:35 AM


SSChampion

SSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampionSSChampion

Group: General Forum Members
Last Login: Today @ 12:19 PM
Points: 13,371, Visits: 25,144
Since this is a 2008 forum, let's go with extended events or change data capture. Either of these will let you know who modified data. Triggers are incomplete and can be very resource intensive. Profiler should not be run against a production system. Server-side traces (scripted components of Profiler) are OK, but not as lightweight as extended events. I'd go with extended events.

----------------------------------------------------
"The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood..." Theodore Roosevelt
The Scary DBA
Author of: SQL Server 2012 Query Performance Tuning
SQL Server 2008 Query Performance Tuning Distilled
and
SQL Server Execution Plans

Product Evangelist for Red Gate Software
Post #1360246
« Prev Topic | Next Topic »

Add to briefcase

Permissions Expand / Collapse