finding a transaction in old archive logs

[bookouri]

Ive never been asked to do this before, but I have been tasked with trying to locate a transaction that someone made on our production database. We run a batch job every week and this batch job ran last week but failed to run this week and we've spend a couple of days troubleshooting the problem only to find that someone had added a bogus record to a table that caused the job to fail. Because of the nature of the table/records there was no legitimate reason for someone to do this, so it was certainly intentional sabotage. Anyway, I need to go back through the archive's for the last week and try to identify when this bogus transaction was made.

Im guessing I would use logminer for this kind of project, but would like to get some input before i start down the wrong path.

Can anybody point me in the right direction to start?

 

[stefanhei]

Logminer will be a good point to start, but I doubt that a saboteur would log in with a user which may help to identify him. The listener.log may be of interest.

 

[bookouri]

ill give logminer a try, it wouldnt hurt to be familiar with it anyway. I havnt messed with it at all before.