Missing Records ?

[Databaseguy]

OK, Friday afternoon about 2:00 all was well and good. Later that day, production reports to me that several thousand records have disapeared.

There are no stored procedures that delete records, no "back ends" using ODBC and Access (except mine) and no other way to explain what happened.

I know this is a stupid question, but SQL won't just delete records at random, will it ?

What if my max DB size or max Log file size exceeded their limits ? Could this explain what happened.

I hate to think I'd been hacked. But who would just delete records at random ?

Oh, and yes, I did have a backup. It was for Thursday night so we lost Friday.



Tyrone Lumley
augerinn@gte.net

 

[topher0303]

db size or log size will not make data disappear. If db size and log size exceeded limits, the records would not get inserted to begin with. Whatever your process that inserted the data should have recevied errors if that was the case.

You could look into Log mining software. That might tell you if the data was inserted and when it was deleted, assuming it was actually added and deleted.

Chris.

 

[SemperFiDownUnda]

SQL will not loose records. If they where visible then disappeared then someone deleted them. I am assuming that your production people would have notified you of any critical errors on your database.

You say there are no applications that delete data. Then someone would have had to execute a SQL statement to delete them. As mentioned disk space will not destroy records only prevent you from adding new data.

I'm assuming your system does not allow dirty reads.
One thing you can try is to back up your transaction log and restore thursday backup and apply the transaction log backup to 2:00pm. No need to mine the log. If you know about where the problem occured you can get the data up to that point.

Lookup RESTORE DATABASE

look like this

RESTORE DATABASE MyNwind
FROM MyNwind_1, MyNwind_2
WITH NORECOVERY
GO
RESTORE LOG MyNwind
FROM MyNwind_log1
WITH RECOVERY, STOPAT = 'Jul 1, 1998 10:00 AM'
GO
RESTORE LOG MyNwind
FROM MyNwind_log2
WITH RECOVERY, STOPAT = 'Jul 1, 1998 10:00 AM'
GO