Question ...

... someone or some software removed data from
one table of my SQL Server 2005 database. How to check
who/when did that? What do i have to turn on for
the future investigation of that cause?Jacek Jurkowski wrote:
> ... someone or some software removed data from
> one table of my SQL Server 2005 database. How to check
> who/when did that? What do i have to turn on for
> the future investigation of that cause?
Hi,
SQL Server it self hasn't got this feature directly. You'll have to
write some triggers that can fire on deletions/updates and update a
"logging"/"history" table with the necessary info.
--
Regards
Steen Schlüter Persson
Database Administrator / System Administrator|||Hi,
you will either have to implement triggers , start a profiler on the
database (which would bevery expensive in performance) or use a log
reader after things happened.
HTH, Jens K. Suessmeyer.
--
http://www.sqlserver2005.de
--|||In addition to others, in SQL Server 2005 you can create event notification
to catch this info
"Jacek Jurkowski" <jjurkowski@.data-comp.eu> wrote in message
news:F5D999D4-F77C-4DFB-A7D8-14EA589E70C9@.microsoft.com...
> ... someone or some software removed data from
> one table of my SQL Server 2005 database. How to check
> who/when did that? What do i have to turn on for
> the future investigation of that cause?|||To add to the other responses, if data was very recently deleted and you
have the default trace enabled, you might get lucky and find the command in
the default trace. These default trace files are created in the log folder
and can be opened with Profiler or fn_trace_gettable. For example:
SELECT *
FROM fn_trace_gettable('C:\Program Files\Microsoft SQL
Server\MSSQL.1\MSSQL\LOG\log.trc', default)
--
Hope this helps.
Dan Guzman
SQL Server MVP
"Jacek Jurkowski" <jjurkowski@.data-comp.eu> wrote in message
news:F5D999D4-F77C-4DFB-A7D8-14EA589E70C9@.microsoft.com...
> ... someone or some software removed data from
> one table of my SQL Server 2005 database. How to check
> who/when did that? What do i have to turn on for
> the future investigation of that cause?