SQL事件探查器 - 没有捕获表删除 [英] SQL Profiler - table delete did not get captured

问题描述

其中一名用户抱怨他们的团队'某人'一周前不小心丢了桌子，但没有人承认。我查看了所有默认跟踪日志，但没有找到任何关于它的信息。但是，是的，表被删除，用户必须重新创建它。

在某些情况下，SQL Profiler无法记录"删除"？我们知道在哪些情况下？

有没有其他方法可以追踪谁放弃它？未启用审核。

解决方案

默认跟踪应捕获对象丢弃。但是，由于它是翻转文件跟踪，旧事件可能因活动而下降。

我不认为除了可能具有取证的默认跟踪之外还有其他来源证据。

One of the user complained 'someone' from their team accidentally dropped a table a week ago but no one confessed it. I went through all default trace logs and did not find any info about it. But, yes the table was deleted and user had to recreate it.

It appears in some scenarios SQL profiler is not able to log 'delete'? Do we know in which scenarios?

Is there any other way to trace who dropped it? Audit is not enabled.

解决方案

The default trace should have captured the object drop. However, since it's a rollover file trace, the older event may have rolled off due to activity.

I don't think there is a source other than the default trace that might have the forensic evidence.

这篇关于SQL事件探查器 - 没有捕获表删除的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！