question regarding database auditing

[maswien]

Someone deleted the databases on purpose, the SQL Server starting fine and most of the critical production databases are gone.

The people who did this must have dba password or can physically logon the box. Looks like the error logs are also modified. Is there any way we can trace this event in SQL Server 2000?

Thanks

 

[SQLDenis]

did you at least change all the passwords, how do you know it won't happen again later today

Is the SQL box accessible from the outside or is it behind a DMZ

Who is responsible for the security of this box?

Denis The SQL Menace
--------------------
SQL Server Code,Tips and Tricks, Performance Tuning
SQLBlog.com, Google Interview Questions

 

[maswien]

Very good suggestion! Thanks Dennis

 

[chrissie1]

How do you know it was somebody else?

Do you have evidence for that?



Christiaan Baes
Belgium

My Blog

 

[gmmastros]

maswien,

Check the keyboard for DNA and/or clothing fibers. If you find any, chrissie will be able to help you.

-George

"The great things about standards is that there are so many to choose from." - Fortune Cookie Wisdom

 

[chrissie1]

I only do fibers. and knots ;-) but I don't think those will be relevant.

DNA is for sissy's.

Christiaan Baes
Belgium

My Blog

 

[eggy168]

So, did anyone have a solution?

I have the similar problem. I will start a thread. Anyhow, I want to reply it here because I have a similar problem in my office.
There must be a user(s) who delete records in a table(s), but we all know there is no way to find who did it.
Is there a trigger, a stored procedure or anything to find it?

Thanks.