Timeline for SQL Server Incident - How to audit [duplicate]
Current License: CC BY-SA 3.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 6, 2017 at 21:57 | vote | accept | NicoRiff | ||
| Feb 6, 2017 at 20:22 | history | closed | Aaron Bertrand sql-server Users with the sql-server badge or a synonym can single-handedly close sql-server questions as duplicates and reopen them as needed. | Duplicate of How to find out who deleted some data SQL Server | |
| Feb 6, 2017 at 19:59 | comment | added | NicoRiff | @HLGEM thanks for advice I also do auditing by triggers on the databases I own and design. Anyway I cannot touch the database schema since it is from another software manufacturer. I´ll give a try to the tools that were exposed in this thread | |
| Feb 6, 2017 at 19:55 | comment | added | HLGEM | You should set up your own auditing through triggers, Profiler should not be used for auditing and should generally not be used in Production at all. Our audit tables capture the exact changes (old and new values) and the login of who did it, the application the change came from, and the datetime of the change. | |
| Feb 6, 2017 at 19:38 | answer | added | Brent Ozar | timeline score: 4 | |
| Feb 6, 2017 at 19:36 | comment | added | Kin Shah | See How to recover deleted data from SQL Server and this answer. Dont run profiler instead look into sql server audit or server side trace. | |
| Feb 6, 2017 at 19:32 | history | migrated | from stackoverflow.com (revisions) | ||
| Feb 6, 2017 at 19:32 | comment | added | NicoRiff | @JotaPardo did not know the tool. I´m gonna take a look at it | |
| Feb 6, 2017 at 19:18 | comment | added | Jota Pardo | If you have a DataBase with Recovery model set Full, Use Apex log software. It is useful. | |
| Feb 6, 2017 at 19:12 | comment | added | NicoRiff | @Heinzi they do have transaction logs backups. The objective here anyway would be to know WHO deleted the info. Restoring in this case is not as much as important as knowing who was the person that deleted that info | |
| Feb 6, 2017 at 19:10 | comment | added | NicoRiff | @RBarryYoung yes, i´ve already figured out that it is not so much that can be done just asking to see if there is something that i´m missing that can be used | |
| Feb 6, 2017 at 19:08 | comment | added | RBarryYoung | If it's a deletion, you can just make sure that the data isn't there anymore. That won't tell you when it was deleted or who did it though. | |
| Feb 6, 2017 at 19:07 | comment | added | Heinzi | Which backup strategy is used? Do you have full transaction log backups? | |
| Feb 6, 2017 at 19:05 | history | asked | NicoRiff | CC BY-SA 3.0 |