June 12, 2008 at 8:13 am
[font="Verdana"]Is there a way to find out the USER who deleted a DB in SQL 2000 and also the date & time as well as the Windows PC login ID. Because we use the same password for SQL 2000, it becomes difficult to trace who deleted a DB. I need this very urgently so as to avoid similar happenings in future.[/font]
June 12, 2008 at 8:52 am
Everyone using the same login(SQL Server login?) makes it difficult. I think this would be recorded in the SQL Server error log, but if nobody connects using a Windows login, you won't be able to tell who it was. You might see something in the server log in Windows Event Viewer. You probably need to have a trace running to capture everything.
Greg
June 12, 2008 at 11:17 am
the IP address of the machine would also be recorded with the SQL login, depends what you are auditing
-----------------------------------------------------------------------------------------------------------
"Ya can't make an omelette without breaking just a few eggs" 😉
June 12, 2008 at 11:17 am
depending what you are auditing, there would be more options of tracing but you need advanced auditing enabled
-----------------------------------------------------------------------------------------------------------
"Ya can't make an omelette without breaking just a few eggs" 😉
June 12, 2008 at 12:43 pm
DBCC LOG(master,#)
# can be -1 through 4. Each brings back different data.
Anyways, run DBCC LOG(master,4) and look for something about 'dbdestroy'. Not sure you're going to find what you're looking for, but this is about the only way I've been able to find events like these on SQL2000 unless you were running a profile or capturing changes with a third party tool.
Viewing 5 posts - 1 through 4 (of 4 total)
You must be logged in to reply to this topic. Login to reply