sql - 审核是否执行了存储过程 - 在事务日志中

Question

我们有带有完整备份和事务日志的 SQL Server 2005 数据库。我们的数据库有问题 - 需要 SQL CSI Forensic 团队提供帮助。

有没有办法查看事务日志并确定是否执行了存储过程？我们知道它发生的时间（如果它发生了），但它是否发生存在争议。

有什么建议么。我知道我们应该一直在记录——我们现在显然正在考虑这个问题。

Answer 1

For updating & deleting data you may be able to figure out what happened using DBCC LOGINFO There are products like apex sql log that will make this analysis much easier. THis will tell you when it happened, but not what user made the call. Although you make have other application level logs (iis logs for example) that may help in this respect.

For selecting or looking at data i'd say you have no chance.

In future if you need this kind of audit trail i suggest you look at SQL's C2 Auditing feature.

Answer 2

There used to be a company called Lumigent that had a program called Log Explorer. I couldn't find the companies web site...and I am not sure if theyr explorer would be able to tell you if a proc was executed...however it would tell you if the statements insite the proc were executed at the time you think they were. If you could find it, Lumigent Log Explorer would probably help.