{"id":4518,"date":"2015-06-03T11:45:32","date_gmt":"2015-06-03T18:45:32","guid":{"rendered":"http:\/\/3.209.169.194\/blogs\/paul\/?p=4518"},"modified":"2015-10-26T06:54:44","modified_gmt":"2015-10-26T13:54:44","slug":"finding-a-transaction-in-the-log-for-a-particular-user","status":"publish","type":"post","link":"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/","title":{"rendered":"Finding a transaction in the log for a particular user"},"content":{"rendered":"<p>In the last IEHADR class we just had in Chicago, I was doing a demo of looking in the transaction log to find the point at which a table was dropped so a restore could be performed (as described in <a href=\"https:\/\/www.sqlskills.com\/blogs\/paul\/using-fn_dblog-fn_dump_dblog-and-restoring-with-stopbeforemark-to-an-lsn\/\" target=\"_blank\">this blog post<\/a>). One of the students asked how to find a transaction for a particular user, so I demo&#8217;d that and thought it would make a good little post.<\/p>\n<p>This can be done using\u00a0<em>fn_dblog<\/em>, or if the relevant log isn&#8217;t available on the system any more, using\u00a0<em>fn_dump_dblog<\/em>, albeit more slowly.<\/p>\n<p>The two pieces of information needed are the user and the rough time that the transaction occurred.<\/p>\n<p>The user can&#8217;t be used to search in the log directly, but every\u00a0<em>LOP_BEGIN_XACT<\/em> log record contains the SID of who ran the transaction. The SID can be obtained from the username using the\u00a0<em>SUSER_SID<\/em> function (remember that it&#8217;s more complicated if someone&#8217;s used\u00a0<em>EXECUTE AS<\/em>, as that can mask who they really are &#8211; details in <a href=\"https:\/\/www.sqlskills.com\/blogs\/paul\/using-transaction-sid-transaction-log\/\" target=\"_blank\">this post<\/a>).<\/p>\n<p>For instance, on my laptop:<\/p>\n<pre class=\"brush: sql; title: ; toolbar: true; wrap-lines: true; notranslate\" title=\"\">\r\nSELECT SUSER_SID ('APPLECROSS\\PAUL') AS &#x5B;SID];\r\nGO\r\n<\/pre>\n<pre class=\"brush: plain; gutter: false; title: ; toolbar: true; wrap-lines: true; notranslate\" title=\"\">\r\nSID\r\n-----------------------------------------------------------------\r\n0x0105000000000005150000008E888D4129BB677CAA278B76E8030000\r\n<\/pre>\n<p>Then you can use that SID as a filter for<em>\u00a0fn_dblog<\/em> (or <em>fn_dump_dblog<\/em>), like so:<\/p>\n<pre class=\"brush: sql; title: ; toolbar: true; wrap-lines: true; notranslate\" title=\"\">\r\nSELECT\r\n\t&#x5B;Current LSN],\r\n\t&#x5B;Operation],\r\n\t&#x5B;Transaction ID],\r\n\t&#x5B;Begin Time],\r\n\tLEFT (&#x5B;Description], 40)\u00a0AS &#x5B;Description]\r\nFROM\r\n\tfn_dblog (NULL, NULL)\r\nWHERE\r\n\t&#x5B;Transaction SID] = SUSER_SID ('APPLECROSS\\PAUL');\r\nGO\r\n<\/pre>\n<pre class=\"brush: plain; gutter: false; title: ; toolbar: true; wrap-lines: true; notranslate\" title=\"\">\r\nCurrent LSN             Operation                       Transaction ID Begin Time               Description\r\n----------------------- ------------------------------- -------------- ------------------------ ----------------------------------------\r\n00000021:0000049d:0001  LOP_BEGIN_XACT                  0000:000006c8  2015\/06\/03 11:18:13:790  Backup:CommitDifferentialBase;0x01050000\r\n00000021:000004a5:0001  LOP_BEGIN_XACT                  0000:000006c9  2015\/06\/03 11:18:13:810  Backup:CommitLogArchivePoint;0x010500000\r\n00000021:000004a5:0002  LOP_BEGIN_XACT                  0000:000006ca  2015\/06\/03 11:18:13:810  Backup:CommitLogArchivePoint;0x010500000\r\n00000021:000004a7:0003  LOP_BEGIN_XACT                  0000:000006cb  2015\/06\/03 11:18:13:820  INSERT;0x0105000000000005150000008e888d4\r\n00000021:000004a7:0004  LOP_BEGIN_XACT                  0000:000006cc  2015\/06\/03 11:18:13:820  AllocHeapPageSimpleXactDML;0x01050000000\r\n00000021:000004a7:0007  LOP_BEGIN_XACT                  0000:000006cd  2015\/06\/03 11:18:13:820  AllocFirstPage;0x01050000000000051500000\r\n00000021:000004ad:0002  LOP_BEGIN_XACT                  0000:000006ce  2015\/06\/03 11:18:13:820  INSERT;0x0105000000000005150000008e888d4\r\n00000021:000004ae:0001  LOP_BEGIN_XACT                  0000:000006cf  2015\/06\/03 11:18:16:112  INSERT;0x0105000000000005150000008e888d4\r\n00000021:000004af:0001  LOP_BEGIN_XACT                  0000:000006d0  2015\/06\/03 11:19:17:306  INSERT;0x0105000000000005150000008e888d4\r\n00000021:000004b0:0001  LOP_BEGIN_XACT                  0000:000006d1  2015\/06\/03 11:22:35:451  DELETE;0x0105000000000005150000008e888d4\r\n00000021:000004b1:0001  LOP_BEGIN_XACT                  0000:000006d2  2015\/06\/03 11:27:42:998  INSERT;0x0105000000000005150000008e888d4\r\n00000021:000004b2:0001  LOP_BEGIN_XACT                  0000:000006d3  2015\/06\/03 11:29:56:044  DELETE;0x0105000000000005150000008e888d4\r\n\r\n.\r\n.\r\n.\r\n<\/pre>\n<p>Obviously the transactions above are a contrived example. You can imagine the case of lots of transactions spread out over a few hours (or even over a day, being investigated through log backups with\u00a0<em>fn_dump_dblog<\/em>) and to narrow it down to the transaction you want you could look through the list manually for the rough time or specify a time range on the\u00a0<em>SELECT<\/em> using predicates on\u00a0the\u00a0<em>Begin Time<\/em> column in the\u00a0<em>fn_dblog<\/em> output.<\/p>\n<p>For example:<\/p>\n<pre class=\"brush: sql; title: ; toolbar: true; wrap-lines: true; notranslate\" title=\"\">\r\nSELECT\r\n\t&#x5B;Current LSN],\r\n\t&#x5B;Operation],\r\n\t&#x5B;Transaction ID],\r\n\t&#x5B;Begin Time],\r\n\tLEFT (&#x5B;Description], 40) AS &#x5B;Description]\r\nFROM\r\n\tfn_dblog (NULL, NULL)\r\nWHERE\r\n\t&#x5B;Transaction SID] = SUSER_SID ('APPLECROSS\\PAUL')\r\nAND (&#x5B;Begin Time] &gt; '2015\/06\/03 11:18:15' AND &#x5B;Begin Time] &lt; '2015\/06\/03 11:18:25');\r\nGO\r\n<\/pre>\n<pre class=\"brush: plain; gutter: false; title: ; toolbar: true; wrap-lines: true; notranslate\" title=\"\">\r\nCurrent LSN             Operation                       Transaction ID Begin Time               Description\r\n----------------------- ------------------------------- -------------- ------------------------ ----------------------------------------\r\n00000021:000004ae:0001  LOP_BEGIN_XACT                  0000:000006cf  2015\/06\/03 11:18:16:112  INSERT;0x0105000000000005150000008e888d4\r\n00000021:000004af:0001  LOP_BEGIN_XACT                  0000:000006d0  2015\/06\/03 11:19:17:306  INSERT;0x0105000000000005150000008e888d4\r\n00000021:000004b0:0001  LOP_BEGIN_XACT                  0000:000006d1  2015\/06\/03 11:22:35:451  DELETE;0x0105000000000005150000008e888d4\r\n<\/pre>\n<p>And if you knew what the operation was, you could narrow it down by the\u00a0<em>Description<\/em> too.<\/p>\n<p>Then it&#8217;s a simple case of taking\u00a0the <em>Current LSN<\/em> of the\u00a0<em>LOP_BEGIN_XACT<\/em> log record of the transaction you&#8217;re interested in, and restoring a copy of the database using the\u00a0<em>STOPBEFOREMARK<\/em> trick (that I showed in my <a href=\"https:\/\/www.sqlskills.com\/blogs\/paul\/using-fn_dblog-fn_dump_dblog-and-restoring-with-stopbeforemark-to-an-lsn\/\" target=\"_blank\">previous post<\/a> on using this stuff) to restore to a point just before that transaction.<\/p>\n<p>Enjoy!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the last IEHADR class we just had in Chicago, I was doing a demo of looking in the transaction log to find the point at which a table was dropped so a restore could be performed (as described in this blog post). One of the students asked how to find a transaction for a [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,35,98,100],"tags":[],"class_list":["post-4518","post","type-post","status-publish","format-standard","hentry","category-backuprestore","category-disaster-recovery","category-transaction-log","category-undocumented-commands"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Finding a transaction in the log for a particular user - Paul S. Randal<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Finding a transaction in the log for a particular user - Paul S. Randal\" \/>\n<meta property=\"og:description\" content=\"In the last IEHADR class we just had in Chicago, I was doing a demo of looking in the transaction log to find the point at which a table was dropped so a restore could be performed (as described in this blog post). One of the students asked how to find a transaction for a [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/\" \/>\n<meta property=\"og:site_name\" content=\"Paul S. Randal\" \/>\n<meta property=\"article:published_time\" content=\"2015-06-03T18:45:32+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2015-10-26T13:54:44+00:00\" \/>\n<meta name=\"author\" content=\"Paul Randal\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Paul Randal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/\",\"url\":\"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/\",\"name\":\"Finding a transaction in the log for a particular user - Paul S. Randal\",\"isPartOf\":{\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/paul\/#website\"},\"datePublished\":\"2015-06-03T18:45:32+00:00\",\"dateModified\":\"2015-10-26T13:54:44+00:00\",\"author\":{\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/paul\/#\/schema\/person\/ffcec826c18782e1e0adf173826a7fce\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.sqlskills.com\/blogs\/paul\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Finding a transaction in the log for a particular user\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/paul\/#website\",\"url\":\"https:\/\/www.sqlskills.com\/blogs\/paul\/\",\"name\":\"Paul S. Randal\",\"description\":\"In Recovery...\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.sqlskills.com\/blogs\/paul\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/paul\/#\/schema\/person\/ffcec826c18782e1e0adf173826a7fce\",\"name\":\"Paul Randal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.sqlskills.com\/blogs\/paul\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0b6a266bba2f088f2551ef529293001bd73bf026bc1908b9866728c062beeeb6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0b6a266bba2f088f2551ef529293001bd73bf026bc1908b9866728c062beeeb6?s=96&d=mm&r=g\",\"caption\":\"Paul Randal\"},\"sameAs\":[\"http:\/\/3.209.169.194\/blogs\/paul\"],\"url\":\"https:\/\/www.sqlskills.com\/blogs\/paul\/author\/paul\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Finding a transaction in the log for a particular user - Paul S. Randal","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/","og_locale":"en_US","og_type":"article","og_title":"Finding a transaction in the log for a particular user - Paul S. Randal","og_description":"In the last IEHADR class we just had in Chicago, I was doing a demo of looking in the transaction log to find the point at which a table was dropped so a restore could be performed (as described in this blog post). One of the students asked how to find a transaction for a [&hellip;]","og_url":"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/","og_site_name":"Paul S. Randal","article_published_time":"2015-06-03T18:45:32+00:00","article_modified_time":"2015-10-26T13:54:44+00:00","author":"Paul Randal","twitter_misc":{"Written by":"Paul Randal","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/","url":"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/","name":"Finding a transaction in the log for a particular user - Paul S. Randal","isPartOf":{"@id":"https:\/\/www.sqlskills.com\/blogs\/paul\/#website"},"datePublished":"2015-06-03T18:45:32+00:00","dateModified":"2015-10-26T13:54:44+00:00","author":{"@id":"https:\/\/www.sqlskills.com\/blogs\/paul\/#\/schema\/person\/ffcec826c18782e1e0adf173826a7fce"},"breadcrumb":{"@id":"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.sqlskills.com\/blogs\/paul\/finding-a-transaction-in-the-log-for-a-particular-user\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.sqlskills.com\/blogs\/paul\/"},{"@type":"ListItem","position":2,"name":"Finding a transaction in the log for a particular user"}]},{"@type":"WebSite","@id":"https:\/\/www.sqlskills.com\/blogs\/paul\/#website","url":"https:\/\/www.sqlskills.com\/blogs\/paul\/","name":"Paul S. Randal","description":"In Recovery...","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.sqlskills.com\/blogs\/paul\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.sqlskills.com\/blogs\/paul\/#\/schema\/person\/ffcec826c18782e1e0adf173826a7fce","name":"Paul Randal","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.sqlskills.com\/blogs\/paul\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/0b6a266bba2f088f2551ef529293001bd73bf026bc1908b9866728c062beeeb6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0b6a266bba2f088f2551ef529293001bd73bf026bc1908b9866728c062beeeb6?s=96&d=mm&r=g","caption":"Paul Randal"},"sameAs":["http:\/\/3.209.169.194\/blogs\/paul"],"url":"https:\/\/www.sqlskills.com\/blogs\/paul\/author\/paul\/"}]}},"_links":{"self":[{"href":"https:\/\/www.sqlskills.com\/blogs\/paul\/wp-json\/wp\/v2\/posts\/4518","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sqlskills.com\/blogs\/paul\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sqlskills.com\/blogs\/paul\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sqlskills.com\/blogs\/paul\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sqlskills.com\/blogs\/paul\/wp-json\/wp\/v2\/comments?post=4518"}],"version-history":[{"count":0,"href":"https:\/\/www.sqlskills.com\/blogs\/paul\/wp-json\/wp\/v2\/posts\/4518\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.sqlskills.com\/blogs\/paul\/wp-json\/wp\/v2\/media?parent=4518"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sqlskills.com\/blogs\/paul\/wp-json\/wp\/v2\/categories?post=4518"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sqlskills.com\/blogs\/paul\/wp-json\/wp\/v2\/tags?post=4518"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}