Re: WHO DID IT?

From: Jim Conboy <Jim.Conboy_at_trw.com>
Date: Thu, 17 Aug 2000 06:18:26 -0700
Message-Id: <10592.114828@fatcity.com>

If the database hasn't been bounced, see if any suspicious (DELETE or =

TRUNCATE) statements can be found in V$SQLAREA (look at sql_text).  Then =
join parsing_user_id to user# in sys.user$ to find the username.  If the =
DB has been bounced, and you don't have auditing on, I don't know of any =

other way to do this.

Jim

>>> rferguso_at_level1.com 08/16/00 06:47PM >>>

a production database has misteriously lost all of its data...I can = re-create it=20
from backup but before I do I'd like to find out who was the last person = to=20
access certain tables in order to find out who truncated everything...does= =20
anyone have a method to find the culprit?

thanks in advance...
super-sluth...:)

--=20
Author: Roy Ferguson
  INET: rferguso_at_level1.com=20

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists
--------------------------------------------------------------------

To REMOVE yourself from this mailing list, send an E-Mail message to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing). Received on Thu Aug 17 2000 - 08:18:26 CDT