how can we check who deleted the transaction even after few days in sql server 2008 r2 is there any command instead of logs
1
-
Isn't this a duplicate of How to find out who deleted some data SQL Server? Your only options are those enumerated by Gbn or using the system function fn_dblog as in Mark's answer. And that only if you have the log files with data. If you were on simple recovery model you're out of options. Otherwise you need to implement audit for the future.– MarianCommented Feb 22, 2012 at 10:33
Add a comment
|
2 Answers
You'd have to do forensics on the transaction logs using 3rd party tools
Of course, the log entries may not be there due to backups or simple recovery.
If you want auditing, build it in. And restrict permissions of course.
-
fwiw - Sql Log Rescue is only compatible with Sql Server 2000– Justin CCommented Apr 20, 2012 at 14:36
-
None of the tools can help if the transactions you want to read are overwritten by new ones. This doesn't happen in Full recovery model (except when you create a transaction log backup, but then the transactions are safe in the backup file). Also, there is a chance to read the transactions even when you're in Simple recovery model, if there were not many new transactions that could overwrite the old ones. The less subsequent transactions, the better chances to read the ones you want.
answered Sep 14, 2012 at 11:46
