SQL Server誤刪表查看

轉自：http://blog.51cto.com/aimax/2134572

 

SQL Server 完全恢復模式 下恢復誤刪除的表，進行 精准 恢復

1.  找出被刪除的表名(無schema，需要從日志中分析進行提取，后續完善)、object_id、表所在數據庫、刪除人、刪除時間等

declare @database_name varchar(200),@type varchar(2),@pass_hours int,
select @database_name='AdventureWorks2014',@pass_hours=-48
declare @file_path sql_variant
select @file_path=value from fn_trace_getinfo(0) where property=2 and traceid=1
SELECT max(gt.HostName) as 'LoginHostName'
,max(gt.ApplicationName) as 'ApplicationName'
,max(gt.LoginName) as 'LoginName'
,min(gt.StartTime) as 'MinStartTime'
,max(gt.StartTime) as 'MaxStartTime'
,gt.ObjectID
,max(gt.ServerName) as 'DBServerName'
,max(gt.ObjectName) as 'ObjectName'
,max(gt.DatabaseName) as 'DatabaseName'
,max(sv.subclass_name) as 'subclass_name'
,max(e.name) as 'OperationType'
FROM fn_trace_gettable(convert(varchar(2000),@file_path), DEFAULT) gt 
LEFT JOIN sys.trace_subclass_values sv 
ON gt.[eventclass] = sv.[trace_event_id] AND sv.[subclass_value] = gt.[objecttype] 
INNER JOIN sys.trace_events e 
ON gt.[eventclass] = e.[trace_event_id] 
INNER JOIN sys.trace_categories c 
ON e.[category_id] = c.[category_id] 
WHERE StartTime>=dateadd(HOUR,@pass_hours,getdate()) and StartTime<=getdate()
and [eventclass]=47 --drop talbe/index
and databasename=@database_name
and subclass_name='U'
group by gt.ObjectID

 

 

2. 通過刪除時間確定相關信息被記錄在哪個日志文件上

select * from msdb.dbo.backupmediafamily where media_set_id=(
select top 1 media_set_id from msdb.dbo.backupset 
where database_name=@database_name
and backup_finish_date>=@max_start_time
and type='L' order by backup_finish_date)

 

 

3. 從日志文件提取lsn相關信息

declare @lockinfo varchar(100)
set @lockinfo='%SCH_M OBJECT%:'+@ObjectID+':%'
select [Transaction id],'lsn:0x'+[Current LSN] 
from fn_dump_dblog (
        NULL, NULL, N'DISK', 1, @backupfile,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT) as a
where convert(datetime,[Begin Time])
between dateadd(ss,-5,@min_start_time) and dateadd(ss,5,@max_start_time)
and [Transaction Name]='DROPOBJ'
and exists(select 1 from fn_dump_dblog (
        NULL, NULL, N'DISK', 1, @backupfile,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT,
        DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT, DEFAULT)
        where [Transaction id]=a.[Transaction id] and [Lock Information] like @lockinfo)

 

 

4. 恢復所需相關信息

5. 郵件顯示

6. 恢復語句(最后執行的一句)

Restore log DBName from disk='xxx' with stopbeforemark='xxx'

 

 

 

 

 

©著作權歸作者所有：來自51CTO博客作者易語隨風去的原創作品，如需轉載，請注明出處，否則將追究法律責任