Message-Id: <10592.114835@fatcity.com> From: Chuck Hamilton Date: Thu, 17 Aug 2000 06:55:42 -0700 (PDT) Subject: Re: WHO DID IT? --0-1649760492-966520542=:9184 Content-Type: text/plain; charset=us-ascii If you know when it happened you can look at the listener.log to see who logged in at that time. It won't tell you what they did but it will point you in the right direction. Another thought is to use log miner. I don't know if the log records who did what, but it certainly records what was done. Roy Ferguson wrote: a production database has misteriously lost all of its data...I can re-create it from backup but before I do I'd like to find out who was the last person to access certain tables in order to find out who truncated everything...does anyone have a method to find the culprit? thanks in advance... super-sluth...:) -- Author: Roy Ferguson INET: rferguso@level1.com Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051 San Diego, California -- Public Internet access / Mailing Lists -------------------------------------------------------------------- To REMOVE yourself from this mailing list, send an E-Mail message to: ListGuru@fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing). --------------------------------- Do You Yahoo!? Send instant messages & get email alerts with Yahoo! Messenger. --0-1649760492-966520542=:9184 Content-Type: text/html; charset=us-ascii

If you know when it happened you can look at the listener.log to see who logged in at that time. It won't tell you what they did but it will point you in the right direction.

Another thought is to use log miner. I don't know if the log records who did what, but it certainly records what was done.

  Roy Ferguson <rferguso@level1.com> wrote:


a production database has misteriously lost all of its data...I can re-create it
from backup but before I do I'd like to find out who was the last person to
access certain tables in order to find out who truncated everything...does
anyone have a method to find the culprit?

thanks in advance...
super-sluth...:)

--
Author: Roy Ferguson
INET: rferguso@level1.com

Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051
San Diego, California -- Public Internet access / Mailing Lists
--------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru@fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from). You may
also send the H! ELP command for other information (like subscribing).


Do You Yahoo!?
Send instant messages & get email alerts with Yahoo! Messenger.