Tell me more ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.
up vote 1 down vote favorite

I applied logminer to find who deleted a lot of rows in one table. View v$logmnr_contents give me details of that operation. Unfortunately, minimum supplemental logging was not active when archived redo logs were generated, and when I query v$logmnr_contents, I found columns "username" and "session_info" as "unknown".

Would be there any chance to deduce what user did that operation? Maybe using timestamp to determine what users were logged at that time? Or using column Log_ID?

share|improve this question
Have you looked in v$active_session_history (if you're licensed to use ASH) to see if you can see the SQL involved? If the DB hasn't been restarted & the query was recent, the SQL will still be in v$sql and v$sqltext on the Db the operation occurred on. – Phil Sep 13 '12 at 16:13
Yes, I have view v$active_session_history with columns session_id, session_serial#, user_id, sql_id ... but in view v$logmnr_contents columns session# and serial# are empty. – user316687 Sep 13 '12 at 16:33
Right - and you know the SQL that was executed? Look for a piece of it select sql_id, sql_text from v$sql where lower(sql_text) like '%a piece of the query in lowercase%'; on the live database (get the sql_id), then you can look in v$active_session_history in the live database. – Phil Sep 13 '12 at 17:08

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.