rows from a table deleted not sure who and/or when

  • I don't think there is an easy way, but, we had a major table completely emptied(i.e. delete or truncated) and we are not sure when or who did this. Is there a way to view the log to look for mass deletes?

  • You would need to pick up a third party log explorer tool. There's no way to do this with native SQL Server tools.

    "The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood"
    - Theodore Roosevelt

    Author of:
    SQL Server Execution Plans
    SQL Server Query Performance Tuning

  • If this is Sql Server 2005, there will be default trace running.You might find more information there.

  • The default trace doesn't capture DML. I learned that one the hard way.

    "The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood"
    - Theodore Roosevelt

    Author of:
    SQL Server Execution Plans
    SQL Server Query Performance Tuning

  • You might be able to find out when it happened using the fn_dblog function.

    SELECT [transaction id],[begin time],[spid],[allocunitname],[operation]

    FROM fn_dblog(NULL,NULL)

    --WHERE operation='LOP_DELETE_ROWS'

    --WHERE [transaction id]='0000:00027a0a'

Viewing 5 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply