显然我可以使用以下命令在日志中找到drop操作:
SELECT * FROM sys.fn_dblog(NULL, NULL)
WHERE [transaction name] IN ('DROPOBJ');
但我需要找出实际丢弃的内容(函数名称,聚合等),日志似乎主要包含id和二进制数据,而不是名称。如何获取已删除对象的名称(理想情况下不使用第三方工具)?
答案 0 :(得分:2)
答案 1 :(得分:1)
可以看到使用下面的查询(不要忘记切换数据库上下文或手动编写:
USE DATABASE_NAME
GO
然后:
DECLARE @Database_Name NVARCHAR(MAX) = 'DATABASE_NAME'
,@DateFrom DATETIME = '2015-08-01'
,@DateTo DATETIME = GETDATE();
WITH TransactionTable
AS (
SELECT DISTINCT [TRANSACTION ID]
FROM sys.fn_dblog(NULL, NULL)
WHERE Context IN ('LCX_NULL')
AND Operation IN ('LOP_BEGIN_XACT')
AND [Transaction Name] = 'DROPOBJ'
AND CONVERT(NVARCHAR(11), [Begin Time]) BETWEEN @DateFrom
AND @DateTo
)
SELECT [Database Name]
,CONVERT(VARCHAR(Max), SUBSTRING([RowLog Contents 0], 33, LEN([RowLog Contents 0]))) AS [Action]
FROM fn_dblog(NULL, NULL)
WHERE [Operation] = 'LOP_DELETE_ROWS'
AND [Context] = 'LCX_MARK_AS_GHOST'
AND [AllocUnitName] = 'sys.sysobjvalues.clst'
AND [TRANSACTION ID] IN (
SELECT *
FROM TransactionTable
)
AND SUBSTRING([RowLog Contents 0], 33, LEN([RowLog Contents 0])) <> 0