I intend to track delete actions done on a SQL Server DB whose recovery model is simple.
Do such actions get logged when the DB is in this mode?
You can achieve your goal in many different way. If you want you can read delete operations from sql server transaction log, but you will "loose" it after each transaction log backup if you are in full recovery model. In simple recovery model you can not control the transaction log contents.
To find delete operations for a particular table you can use the following query:
DECLARE #MonitoredTable sysname
SET #MonitoredTable = 'YouTable'
SELECT
u.[name] AS UserName
, l.[Begin Time] AS TransactionStartTime
FROM
fn_dblog(NULL, NULL) l
INNER JOIN
(
SELECT
[Transaction ID]
FROM
fn_dblog(NULL, NULL)
WHERE
AllocUnitName LIKE #MonitoredTable + '%'
AND
Operation = 'LOP_DELETE_ROWS'
) deletes
ON deletes.[Transaction ID] = l.[Transaction ID]
INNER JOIN
sysusers u
ON u.[sid] = l.[Transaction SID]
Another approach you can use is to write an "audit trigger" or you can use directly sql server auditing features/Sql server extended events as well explained in this Apex webpage:
SQL Server database auditing techniques
Related
How can I retrieve all T-SQL statements fired by users in last one month in SQL Server database?
I have looked at sys tables but I am not able to figure out where the logs are stored.
In SQL Server we don't keep track of users who execute queries, except for some DML/DDL captured by the default trace or run SQL Profiler
Better to create a server side trace or enable SQL Audit to track down activity from users that you want to track or you don't trust.
If you are using any DMV for capture data, remember that DMV data gets reset if the DMV is cleared out, sql server is restarted, etc.
SQL query:
USE master
go
SELECT sdest.DatabaseName
,sdes.session_id
,sdes.[host_name]
,sdes.[program_name]
,sdes.client_interface_name
,sdes.login_name
,sdes.login_time
,sdes.nt_domain
,sdes.nt_user_name
,sdec.client_net_address
,sdec.local_net_address
,sdest.ObjName
,sdest.Query
FROM sys.dm_exec_sessions AS sdes
INNER JOIN sys.dm_exec_connections AS sdec ON sdec.session_id = sdes.session_id
CROSS APPLY (
SELECT db_name(dbid) AS DatabaseName
,object_id(objectid) AS ObjName
,ISNULL((
SELECT TEXT AS [processing-instruction(definition)]
FROM sys.dm_exec_sql_text(sdec.most_recent_sql_handle)
FOR XML PATH('')
,TYPE
), '') AS Query
FROM sys.dm_exec_sql_text(sdec.most_recent_sql_handle)
) sdest
where sdes.session_id <> ##SPID
--and sdes.nt_user_name = '' -- Put the username here !
ORDER BY sdec.session_id
Query Store (SQL Server 2016+) instead of the DMV's. This gives better ability to look into historical data, as well as faster lookups and very efficient to capture short-running queries that can't be captured by sp_who/sp_whoisactive as well.
I have one warehouse server which got data/sync from legacy system 24/7, I noticed some of my reports/sql jobs performance is uncertain and most of the time I heard from DBA team that my query is blocking to other sync process.
From DBA team I came to know command i.e. EXEC SP_WHO2 by which I can identify spid of query which cause blocking by looking into column BlkBy.
Please suggest me how I can avoid blocking and other ways to check blocking in SQL Server
Apart from Sp_Who2 you can use following query to identify blocking in you SQL.
SELECT
db.name DBName,
tl.request_session_id,
wt.blocking_session_id,
OBJECT_NAME(p.OBJECT_ID) BlockedObjectName,
tl.resource_type,
h1.TEXT AS RequestingText,
h2.TEXT AS BlockingTest,
tl.request_mode
FROM sys.dm_tran_locks AS tl
INNER JOIN sys.databases db ON db.database_id = tl.resource_database_id
INNER JOIN sys.dm_os_waiting_tasks AS wt ON tl.lock_owner_address = wt.resource_address
INNER JOIN sys.partitions AS p ON p.hobt_id = tl.resource_associated_entity_id
INNER JOIN sys.dm_exec_connections ec1 ON ec1.session_id = tl.request_session_id
INNER JOIN sys.dm_exec_connections ec2 ON ec2.session_id = wt.blocking_session_id
CROSS APPLY sys.dm_exec_sql_text(ec1.most_recent_sql_handle) AS h1
CROSS APPLY sys.dm_exec_sql_text(ec2.most_recent_sql_handle) AS h2
GO
Also can check detail of particular SPID by using following command.
DBCC INPUTBUFFER(56) — Will give you the Event Info.
KILL 56 -- Will kill the session of this id.
This is a very comprehensive guide. Some basic guidelines though:
Avoid SELECT ... INTO #temp pattern and instead create a table first and use INSERT INTO #Temp SELECT...
Use WITH (NOLOCK) on queries where you can tolerate dirty reads
Ensure proper indexes exist
Use sargable predicates in your WHERE clauses
Talk to your DBA about potentially enabling READ_COMMITTED_SNAPSHOT isolation level
The simplest method is by using the Activity Monitor query within Microsoft’s SQL Server Management Studio (SSMS). To access this query from SSMS: first open up the main window; then click ‘Activity Monitor’ under ‘Tools’; then use either the ‘Processes/Sessions’ tab or specifically select ‘Blocking Processes” from the drop down menu at top left of the monitor window. This will show all currently running processes and their associated session ID's, as well as any transactions they might be involved with such as those that are being blocked by other threads.
You can also check for blocking using a few T-SQL scripts designed explicitly to check locking behavior on working systems. One such script is called SP_WHO2 this simple system-stored procedure displays lock information about active user connections and associated process IDs against all databases running on an instance of SQL server. --Cheers Mike B
I have a copy of an offsite production database used for reporting which is running on SQL Server 2012. I want to start updating it hourly with transaction logs from that offsite production database.
No big deal, restore a full backup (w/ NORECOVERY) to get things started and apply the transaction logs (w/ NORECOVERY) as they come in.
However, in the event of a problem with the restore (or with getting the log files) I could end up with several transaction log files, some of which have been applied and others that have not. When that happens, how do I figure out which file to start with in my TSQL script?
I tried looking in the restore history table like this:
select distinct
h.destination_database_name,
h.restore_date,
s.server_name,
m.physical_device_name as backup_device,
f.physical_name
from
msdb..restorehistory h
inner join
msdb..backupfile f on h.backup_set_id = f.backup_set_id
inner join
msdb..backupset s on f.backup_set_id = s.backup_set_id
inner join
msdb..backupmediafamily m on s.media_set_id = m.media_set_id
where
h.destination_database_name = 'mydb'
and h.restore_date > (GETDATE() -0.5)
order by
h.restore_date
But checking restorehistory is no good because the NORECOVERY flag means no records have been added in that table. So is there another way to check this, via T-SQL, that works for a NORECOVERY database?
Assuming this is a rare manual operation, the simplest way to is scan the errorlog.
SQL Server's built-in log shipping (and some third party implementations) have tables, views and user interfaces that make this simpler.
I need to execute a SSRS reports from SSIS on periodic schedule.
Saw a solution here :
https://www.mssqltips.com/sqlservertip/3475/execute-a-sql-server-reporting-services-report-from-integration-services-package/
But is there any other option in SSIS without using Script Task ? I don't quite understand the script and concern there could be some support issue for me.
Database : SQL Server 2008R2 Standard Edition
Any ideas ? Thanks very much ...
SSIS controlling the running of an SSRS in SQL Agent.
This assumes that the SSIS job will have updated a control record or written some other identifiable record to a database.
1. Create a subscription for the report.
2. Run this SQL to get the GUID of the report
SELECT c.Name AS ReportName
, rs.ScheduleID AS JOB_NAME
, s.[Description]
, s.LastStatus
, s.LastRunTime
FROM
ReportServer..[Catalog] c
JOIN ReportServer..Subscriptions s ON c.ItemID = s.Report_OID
JOIN ReportServer..ReportSchedule rs ON c.ItemID = rs.ReportID
AND rs.SubscriptionID = s.SubscriptionID<br>
3. Create a SQL Agent job.
a. Step 1. A SQL statement to look for data in a table containing a flagged record where the Advanced setting is "on failure end job reporting success"
IF NOT exists ( select top 1 * from mytable where mykey = 'x'
and mycondition = 'y') RAISERROR ('No Records Found',16,1)
b. Step 2
USE msdb
EXEC sp_start_job #job_name = ‘1X2C91X5-8B86-4CDA-9G1B-112C4F6E450A'<br>
Replacing the GUID with the one returned from your GUID query.
One thing to note though ... once the report subscription has been executed then as far as SQL Agent is concerned then that step is complete, even though the report has not necessarily finished running. I once had a clean up job after the Exec step which effectively deleted some of my data before the report reached it!
You can create a subscription for the report that is never scheduled to run.
If you have the Subscription ID, you can fire the report subscription using a simple SQL Task in SSIS.
You can get the Subscription ID from the Report Server database. It is in the Subscriptions table.
Use this query to help locate the subscription:
SELECT Catalog.Path
,Catalog.Name
,SubscriptionID
,Subscriptions.Description
FROM Catalog
INNER JOIN Subscriptions
ON Catalog.ItemID = Subscriptions.Report_OID
In SSIS, you can use this statement, inside of a SQL Task, to fire the subscription:
EXEC reportserver.dbo.AddEvent #EventType='TimedSubscription',#EventData= [Your Subscription ID]
Hope this helps.
I am trying to query the DMVs in SQL Server 2008 R2.
On this server are two user databases called histrx and OpenLink. To prove I have their names correct:
select db_id('histrx') -- Returns 5
select db_id('OpenLink') -- Returns 7
If I run the following query, picking out entries for the histrx database, I get 25 rows in the result set:
select top 25
total_worker_time/execution_count as avg_worker_time,
total_logical_reads/execution_count as avg_logical_reads,
db_name(s.dbid) as [db_name],
object_name(s.objectid, s.dbid) as [object_name],
execution_count,
plan_generation_num,
last_execution_time,
creation_time,
[text],
p.query_plan
from
sys.dm_exec_query_stats qs
CROSS APPLY sys.dm_exec_sql_text(qs.plan_handle) s
CROSS APPLY sys.dm_exec_query_plan(qs.plan_handle) p
where
db_name(s.dbid) = 'histrx'
order by
avg_logical_reads desc
If I then change the where clause to the following, no rows are returned:
where
db_name(s.dbid) = 'OpenLink'
I know that there is a significant amount of activity on the OpenLink database. If I look at Recent Expensive Queries in the Activity Monitor, I can see entries for OpenLink, and I'm pretty sure this is using the DMVs underneath.
I'm running the Activity Monitor and the DMV query under the same
login
That login is the owner of the OpenLink database
If I run select * from fn_my_permissions (NULL, 'server'); then I can see I have VIEW SERVER STATE permissions
If I remove the where clause, I see entries for other databases such as msdb and distribution
Here is a screenshot of the mappings for my login. I'm pretty sure I shouldn't be the owner, but that's a different question.
Can anyone tell me why my DMV query is returning zero rows for this database?
Quote from Books Online 2008 R2 > sys.dm_exec_sql_text:
dbid smallint ID of database. Is NULL for ad hoc and prepared SQL
statements.
1) So, for this type of SQL statements, where db_name(s.dbid) = 'OpenLink' means where NULL = 'OpenLink' and this predicate is evaluated to UNKNOWN.
2) dbid column is NOT NULL for "non-adhoc and non-prepared SQL" statements (ex. for stored procedures).
3) For SQL 2008R2 you might get the dbid for "ad hoc and prepared SQL statements" from sys.dm_exec_plan_attributes ( plan_handle ) function (link) using this query:
SELECT
...
ISNULL(src.dbid,CONVERT(SMALLINT,att.value)) AS my_dbid,
DB_NAME(ISNULL(src.dbid,CONVERT(SMALLINT,att.value))) my_dbname,
...
FROM
sys.dm_exec_query_stats qs
...
CROSS APPLY sys.dm_exec_plan_attributes(qs.plan_handle) att
WHERE att.attribute='dbid'