Hello everyone!



I'm from El Salvador and i have a problem, i have a sybase system
running on windows 2000 server, probably a programmer drop a
database...but i dont know who did it?, is it possible to know who drop
the database?, if the answer is yes... plese help me, because we need to
solve this security problem in our company.



Sybase saves all the TSQL and transaction somewhere?,



SALUDOS desde centroamerica


--
Posted via http://dbforums.com

"becker" <member38633@dbforums.com> wrote in message
news:3345398.1063059523@dbforums.com...
>
> Hello everyone!
>
>
>
> I'm from El Salvador and i have a problem, i have a sybase system
> running on windows 2000 server, probably a programmer drop a
> database...but i dont know who did it?, is it possible to know who
drop
> the database?, if the answer is yes... plese help me, because we
need to
> solve this security problem in our company.
>

There is no easy way to do this, but something may be possible.
Provided the transaction log in the master database has not been
truncated, you should be able to find log records for the drop
database.
Do a 'dbcc log(1)' (enable traceflag 3604 first) and look for log
records affecting objects 30 and 31 (sysdatabases and sysusages,
respectively). The BEGINXACT record for the transaction in which these
log records occur, will tell you the exact time when it happened as
well as the suid (which identifies the login name).
In practice, this is actually a bit complicated and requires an
understanding of the transaction log. Without that knowledge, this
procedure may not be feasible.

HTH,

Rob
-------------------------------------------------------------
Rob Verschoor

Certified Sybase Professional DBA for ASE 12.5/12.0/11.5/11.0
and Replication Server 12.5

Author of "Tips, Tricks & Recipes for Sybase ASE" and
"The Complete Sybase ASE Quick Reference Guide"
Online orders accepted at http://www.sypron.nl/shop

mailto:rob@DO.NOT.SPAM.sypron.nl.REMOVE.THIS.DECOY
http://www.sypron.nl
Sypron B.V., P.O.Box 10695, 2501HR Den Haag, The Netherlands
-------------------------------------------------------------

Turn on Sybase audting. You may be able to catch who is doing this in the future.

On Mon, 08 Sep 2003 18:18:43 -0400, becker <member38633@dbforums.com> wrote:
>
> Hello everyone!
>
>
>
> I'm from El Salvador and i have a problem, i have a sybase system
> running on windows 2000 server, probably a programmer drop a
> database...but i dont know who did it?, is it possible to know who drop
> the database?, if the answer is yes... plese help me, because we need to
> solve this security problem in our company.
>
>
>
> Sybase saves all the TSQL and transaction somewhere?,
>
>
>
> SALUDOS desde centroamerica
>
>
> --
> Posted via http://dbforums.com