RE: WHO DID IT?

The last command will tell you who logged in on that day and looking through each users
.history file in each users home directory will tell you who was executing commands on the system.

If you have Oracle auditing on for the schema on any update/insert or delete actions then you will
probably get the information of a timestamp on the file that you can map back to the login time.

The UNIX admin may already have software that is watching even on a further level.

HTH      Heidi

                                                                                           
                    David Barbour                                                          
                    <DBarbour_at_connect        To:     Multiple recipients of list ORACLE-L  
                    south.com>               <ORACLE-L_at_fatcity.com>                        
                    Sent by:                 cc:                                           
                    root_at_fatcity.com         Subject:     RE: WHO DID IT?                  
                                                                                           
                                                                                           
                    08/16/00 08:45 PM                                                      
                    Please respond to                                                      
                    ORACLE-L                                                               
                                                                                           
                                                                                           

If you're on UNIX, check to see if the sysadm has any kind of logging/command history on users.

David A. Barbour
Oracle DBA - ConnectSouth
512-681-9438
dbarbour_at_connectsouth.com

-----Original Message-----
Sent: Wednesday, August 16, 2000 5:47 PM To: Multiple recipients of list ORACLE-L

a production database has misteriously lost all of its data...I can re-create it
from backup but before I do I'd like to find out who was the last person to

access certain tables in order to find out who truncated everything...does anyone have a method to find the culprit?

thanks in advance...
super-sluth...:)

--
Author: Roy Ferguson
  INET: rferguso_at_level1.com

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists
--------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L


(or the name of mailing list you want to be removed from).  You may

also send the HELP command for other information (like subscribing).
--
Author: David Barbour
  INET: DBarbour_at_connectsouth.com

Fat City Network Services    -- (858) 538-5051  FAX: (858) 538-5051
San Diego, California        -- Public Internet access / Mailing Lists
--------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L


(or the name of mailing list you want to be removed from).  You may