Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I am using an SQL Server 2012 on windows datacenter 2012

I have encountered a situation where i think some virus/sql injection had heart my database,

Some data on my table had changed to weird link's and it was 100% not coming from my system,

I wish to know what is the best way to track the origin of this change, Is there a way to look in the transactional logs and checek which ip/machine had changed a table ? and what were the changes ?

Thanks.

EDIT :

Maybe is there some software like fiddler\wireshark that can trace the sql queries that are being sent to a server ?

share|improve this question

3 Answers 3

SQL Injection is hard to track from SQL Server side. If you want to find out who change what, then some sort of tracing should be running on your server.

If no tracing (custom one implemented by your company DBA or sysadmin) is running, then you can check

Above all are few areas to look into, but it will be difficult for you to corelate and find a pattern.

Best is to scan your web-server IIS error logs using tools like LogParser.

Additional References :

share|improve this answer

Do you have the txn log backup file? There are several products on the market that facilitate the analysis of t-log - I don't believe the host name is included in this information.

Yes - you can run a trace or xevent (or use the Audit functionality) to capture hostname information..

share|improve this answer
    
What is txn log backup ? –  Matan L Aug 23 '13 at 15:03
    
@MatanL Its transaction log backup. But it wont help you getting details about SQL Injection. –  Kin Aug 23 '13 at 16:27

You can use the SQL Server Auditing feature to track queries. Using the feature as the method for tracking execution of queries produces less impact on the server performance comparing to trace technology. However, depending on the database traffic, performance issues can occur. Therefore, be careful what Audit Action Type options you select when defining audit server/database specification(s).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.