If you like DNray Forum, you can support it by - BTC: bc1qppjcl3c2cyjazy6lepmrv3fh6ke9mxs7zpfky0 , TRC20 and more...

 

Tracking Table Changes in SQL Server

Started by bjamesv8, Oct 02, 2024, 12:30 AM

Previous topic - Next topic

bjamesv8Topic starter

Is there a way to query the system tables or logs in SQL Server to determine which tables have undergone DML (Data Manipulation Language) operations, such as INSERT, UPDATE, or DELETE, within a specific date range?
  •  


oqvjAcourseTors

You'll need to enable auditing on your SQL Server instance. This can be done by creating a Server Audit Specification, which defines the events to be audited, such as DML operations. You can create a new audit specification using the following T-SQL command:

CREATE SERVER AUDIT SPECIFICATION [DML_Audit]
FOR SERVER AUDIT [YourAuditName]
ADD (INSERT, UPDATE, DELETE ON DATABASE::[YourDatabaseName] BY public)
WITH (STATE = ON);

Replace [YourAuditName] and [YourDatabaseName] with your actual audit name and database name, respectively.

Once the audit specification is in place, you can query the sys.fn_get_audit_file system function to retrieve the audit log data. This function returns a table with columns like event_time, database_name, schema_name, object_name, and statement, which contain the information you need to identify the tables that have undergone DML operations.

To filter the results by a specific date range, you can use the event_time column in conjunction with the DATE and TIME functions. Here's an example query:

SELECT
    database_name,
    schema_name,
    object_name,
    statement,
    event_time
FROM
    sys.fn_get_audit_file('YourAuditFile Path', default, default) AS af
WHERE
    event_time >= DATEADD(day, -7, GETDATE()) AND event_time < GETDATE()
    AND (statement LIKE '%INSERT%' OR statement LIKE '%UPDATE%' OR statement LIKE '%DELETE%');

This query retrieves the audit log data for the past 7 days, filtering out any events that aren't related to DML operations.

Now, to get a list of unique tables that have undergone DML operations within the specified date range, you can use the DISTINCT keyword and group the results by the object_name column:

SELECT DISTINCT
    object_name
FROM
    (
        SELECT
            database_name,
            schema_name,
            object_name,
            statement,
            event_time
        FROM
            sys.fn_get_audit_file('YourAuditFile Path', default, default) AS af
        WHERE
            event_time >= DATEADD(day, -7, GETDATE()) AND event_time < GETDATE()
            AND (statement LIKE '%INSERT%' OR statement LIKE '%UPDATE%' OR statement LIKE '%DELETE%')
    ) AS DML_Operations;

This will give you a list of tables that have been modified through DML operations within the specified date range.
  •  

Sedfinder

I'd approach this from two distinct angles. Firstly, from a system admin's vantage point, we're talking about log scraping and incremental backups. This ensures that we've got a comprehensive audit trail and can restore our data to a specific point in time, should things go awry. On the other hand, from a Data Engineering perspective, we're dealing with SCD-2 (Slowly Changing Dimension) - a clever technique for managing changes to dimension tables over time.

If you're new to this concept, I recommend checking out the Wikipedia article on SCD-2 for a deeper dive: https://en.wikipedia.org/wiki/Slowly_changing_dimension. In essence, SCD-2 allows us to maintain a historical record of changes to our data, ensuring data integrity and facilitating more accurate analytics.
  •  

minaFeala

To gain insight into general SQL Server activity, follow these steps:

Navigate to Object Explorer and expand the Management node. This will grant you access to a plethora of logging options.
Right-click on SQL Server Logs and select View. You'll be presented with two options: SQL Server Log and SQL Server and Windows Log. Choose the one that suits your needs.
Alternatively, expand SQL Server Logs, right-click on any log file, and select View. You can also double-click on any log file to view its contents.
These logs encompass a broad range of activities, including:

Database Mail
SQL Server
SQL Server Agent
Windows NT
Job-Specific Logs: Drilling Down

To view logs related to specific jobs, follow these steps:

In Object Explorer, expand SQL Server Agent and right-click on Jobs.
Click on View History to access the logs.
These logs provide valuable information on:

Database Mail
Job History
SQL Server Agent
Maintenance Plan Logs: Ensuring Data Integrity

To view logs related to maintenance plans, follow these steps:

In Object Explorer, expand Management and right-click on Maintenance Plans.
Click on View History to access the logs.
These logs cover a range of activities, including:

Database Mail
Job History
Maintenance Plans
Remote Maintenance Plans
SQL Server Agent
Data Collection Logs: Uncovering Hidden Insights

To view logs related to Data Collection, follow these steps:

In Object Explorer, expand Management and right-click on Data Collection.
Click on View Logs to access the logs.
These logs provide valuable information on:

Data Collection
Job History
SQL Server Agent
Database Mail Logs: Tracking Communication

To view logs related to Database Mail, follow these steps:

In Object Explorer, expand Management and right-click on Database Mail.
Click on View Database Mail Log to access the logs.
These logs cover a range of activities, including:

Database Mail
Job History
Maintenance Plans
Remote Maintenance Plans
SQL Server
SQL Server Agent
Windows NT
Audit Logs: Ensuring Compliance

To view logs related to audits, follow these steps:

In Object Explorer, expand Security and Audits.
Right-click on an audit and select View Audit Logs.
These logs provide valuable information on:

Audit Collection
Windows NT
  •  


If you like DNray forum, you can support it by - BTC: bc1qppjcl3c2cyjazy6lepmrv3fh6ke9mxs7zpfky0 , TRC20 and more...