Re: WHO DID IT?

--0-1649760492-966520542=:9184
Content-Type: text/plain; charset=us-ascii

If you know when it happened you can look at the listener.log to see who logged in at that time. It won't tell you what they did but it will point you in the right direction. Another thought is to use log miner. I don't know if the log records who did what, but it certainly records what was done.   Roy Ferguson <rferguso_at_level1.com> wrote:

a production database has misteriously lost all of its data...I can re-create it from backup but before I do I'd like to find out who was the last person to access certain tables in order to find out who truncated everything...does anyone have a method to find the culprit?

thanks in advance...
super-sluth...:)

-- 
Author: Roy Ferguson
INET: rferguso_at_level1.com

Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051
San Diego, California -- Public Internet access / Mailing Lists
--------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from). You may
also send the HELP command for other information (like subscribing).


---------------------------------
Do You Yahoo!?
Send instant messages & get email alerts with Yahoo! Messenger.
--0-1649760492-966520542=:9184
Content-Type: text/html; charset=us-ascii



<P>If&nbsp;you know&nbsp;when it happened you can look at the listener.log&nbsp;to see who logged in at that time.&nbsp;It won't tell you what they did but it will point you in the right direction.

<P>Another thought is to use log miner. I don't know if&nbsp;the log records who did what, but it certainly records what was done.

<P>&nbsp; <B><I>Roy Ferguson &lt;rferguso_at_level1.com&gt;</I></B> wrote: <BR></P>

<BLOCKQUOTE style="BORDER-LEFT: #1010ff 2px solid; MARGIN-LEFT: 5px; PADDING-LEFT: 5px"><BR>a production database has misteriously lost all of its data...I can re-create it <BR>from backup but before I do I'd like to find out who was the last person to <BR>access certain tables in order to find out who truncated everything...does <BR>anyone have a method to find the culprit?<BR><BR>thanks in advance...<BR>super-sluth...:)<BR><BR>-- <BR>Author: Roy Ferguson<BR>INET: rferguso_at_level1.com<BR><BR>Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051<BR>San Diego, California -- Public Internet access / Mailing Lists<BR>--------------------------------------------------------------------<BR>To REMOVE yourself from this mailing list, send an E-Mail message<BR>to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in<BR>the message BODY, include a line containing: UNSUB ORACLE-L<BR>(or the name of mailing list you want to be removed from). You may<BR>also send the H!

ELP command for other information (like subscribing).</BLOCKQUOTE><p><br><hr size=1><b>Do You Yahoo!?</b><br>
Send instant messages & get email alerts with Yahoo! Messenger.