Post reply

Default trace to find who deleted the LDF file?

  • January 6, 2016 at 1:04 pm

    #323849

    Hi

    Is this possible to get the details about who deleted the LDF file from a database?

    Thanks.

  • January 6, 2016 at 3:24 pm

    #1850062

    No, at least not from SQL Server. Deleting the ldf is a file operation done in the OS. And it can only be done when the SQL Server service is not running, or when the database is detached or offline. So there is no way for any SQL Server service to see it.

    Ask your systems admin on what audit records they have for file deletions.

    Hugo Kornelis, SQL Server/Data Platform MVP (2006-2016)
    Visit my SQL Server blog: https://sqlserverfast.com/blog/
    SQL Server Execution Plan Reference: https://sqlserverfast.com/epr/

  • January 6, 2016 at 3:30 pm

    #1850064

    Hugo is correct. If SQL Server has control of the file, then it can't be deleted. If it can (offline, db dropped, SQL stopped), then SQL has no knowledge of this.

    Check Windows recycle bin first. Might be a quick fix.

  • January 6, 2016 at 4:02 pm

    #1850069

    If you mean ALTER DATABASE to drop an LDF (can't drop the last one), then that should be in the default trace. If you mean an OS file delete, then no.

    Gail Shaw
    Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
    SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

    We walk in the dark places no others will enter
    We stand on the bridge and no one may pass

Viewing 4 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply