SQL Server 2012：一种查看数据库是否已被篡改的方法？

Question

I have a delicate situation wherein some records in my database are inexplicably missing. Each record has a sequential number, and the number sequence skips over entire blocks. My server program also keeps a log file of all the transactions received and posted to the database, and those missing records do appear in the log, but not in the database. The gaps of missing records coincide precisely with the dates and times of the records that show in the log.

The project, still currently under development, consists of a server program (written by me in Visual Basic 2010) running on a development computer in my office. The system retrieves data from our field personnel via their iPhones (running a specialized app also developed by me). The database is located on another server in our server room.

No one but me has access to my development server, which holds the log files, but there is one other person who has full access to the server that hosts the database: our head IT guy, who has complained that he believes he should have been the developer on this project.

It's very difficult for me to believe he would sabotage my data, but so far there is no other explanation that I can see.

Anyway, enough of my whining. What I need to know is, is there a way to determine who has done what to my database?

Answer 1

If you are using identity for your "sequential number", and your insert statement errors out the identity value will still be incremented even though no record has been inserted. Just another possible cause for this issue outside of "tampering".

Answer 2

Look at the transaction log if it hasn't been truncated yet:

• How to view transaction logs in SQL Server 2008

• How do I view the transaction log in SQL Server 2008?

Answer 3

If you want to catch the changes in real time, I suggest you consider using SqlDependency . This way, when data changes, you will be alerted immediately and can check which user is using the database at the very moment (this could also be done using code).

You can use this code sample.

Coming to think about it, you can establish the same effect using a trigger and writing ti a table active users. Of course, if you are suspecting someone is tempering with data, using SqlDependency might be a better way to go with, as the data will be stored outside of the tampered database.

Answer 4

You can run a trace, for example a distant profiler trace, that will get all SQL queries containing the DELETE keyword. This way, nobody will be aware that queries are traced. You can also query the default trace regularly to get the last DELETE commands: Maintaining SQL Server default trace historical events for analysis and reporting