Mystery Table Delete!

I'm hoping someone out there can help me solve a mystery!
29 tables in our live database were deleted the other day
and we've no real idea how this could have happened.
We have found an entry in Application Event Viewer that
happened at about the same time as the tables vanished,
but we don't really understand what it means:
EventID: 17055
Categorey: (6)
Description: 3041: BACKUP failed to complete the command
dump tran [Claims] with no_log
I understand that this is saying that the command failed,
but where did the command come from? The user on the
event was creating new tables and replacing stored
procedures in the database at the time, however, [Claims]
is the name of the whole database!
We have recovered from the disaster now but really do need
to understand what has happened here, how it happened, and
how we can ensure it never happens again in the future.
Thanks in advance for any help.
Regards
PaulaCheck your web server logs, if there is web application connected. Check
your security logs...
"Pegasus" <anonymous@.discussions.microsoft.com> wrote in message
news:212c301c45a9e$73c9e3c0$a301280a@.phx.gbl...
> I'm hoping someone out there can help me solve a mystery!
> 29 tables in our live database were deleted the other day
> and we've no real idea how this could have happened.
> We have found an entry in Application Event Viewer that
> happened at about the same time as the tables vanished,
> but we don't really understand what it means:
> EventID: 17055
> Categorey: (6)
> Description: 3041: BACKUP failed to complete the command
> dump tran [Claims] with no_log
> I understand that this is saying that the command failed,
> but where did the command come from? The user on the
> event was creating new tables and replacing stored
> procedures in the database at the time, however, [Claims]
> is the name of the whole database!
> We have recovered from the disaster now but really do need
> to understand what has happened here, how it happened, and
> how we can ensure it never happens again in the future.
> Thanks in advance for any help.
> Regards
> Paula|||There is no web application connected (to my knowledge)
and nothing is showing in the security logs.
Using SQL Server 2000.
Has been suggested that using Enterprise Manager and the
DTS Import/Export Wizard to move objects could have caused
the tables to be dropped? Any value in this theory?
>--Original Message--
>Check your web server logs, if there is web application
connected. Check
>your security logs...
>"Pegasus" <anonymous@.discussions.microsoft.com> wrote in
message
>news:212c301c45a9e$73c9e3c0$a301280a@.phx.gbl...
>> I'm hoping someone out there can help me solve a
mystery!
>> 29 tables in our live database were deleted the other
day
>> and we've no real idea how this could have happened.
>> We have found an entry in Application Event Viewer that
>> happened at about the same time as the tables vanished,
>> but we don't really understand what it means:
>> EventID: 17055
>> Categorey: (6)
>> Description: 3041: BACKUP failed to complete the command
>> dump tran [Claims] with no_log
>> I understand that this is saying that the command
failed,
>> but where did the command come from? The user on the
>> event was creating new tables and replacing stored
>> procedures in the database at the time, however,
[Claims]
>> is the name of the whole database!
>> We have recovered from the disaster now but really do
need
>> to understand what has happened here, how it happened,
and
>> how we can ensure it never happens again in the future.
>> Thanks in advance for any help.
>> Regards
>> Paula
>
>.
>|||Probably the best way to see might be to get the tool from Lumigent (
www.lumigent.com)...
Give them a call and see if the tool will help in your situation.
--
Wayne Snyder, MCDBA, SQL Server MVP
Mariner, Charlotte, NC
www.mariner-usa.com
(Please respond only to the newsgroups.)
I support the Professional Association of SQL Server (PASS) and it's
community of SQL Server professionals.
www.sqlpass.org
"Pegasus" <anonymous@.discussions.microsoft.com> wrote in message
news:212c301c45a9e$73c9e3c0$a301280a@.phx.gbl...
> I'm hoping someone out there can help me solve a mystery!
> 29 tables in our live database were deleted the other day
> and we've no real idea how this could have happened.
> We have found an entry in Application Event Viewer that
> happened at about the same time as the tables vanished,
> but we don't really understand what it means:
> EventID: 17055
> Categorey: (6)
> Description: 3041: BACKUP failed to complete the command
> dump tran [Claims] with no_log
> I understand that this is saying that the command failed,
> but where did the command come from? The user on the
> event was creating new tables and replacing stored
> procedures in the database at the time, however, [Claims]
> is the name of the whole database!
> We have recovered from the disaster now but really do need
> to understand what has happened here, how it happened, and
> how we can ensure it never happens again in the future.
> Thanks in advance for any help.
> Regards
> Paula|||Try a log tool like LogExplorer from www.lumigent.com or ApexSQL Log from
www.apexsql.com to trawl trough your transaction logs and see what happened.
--
Jacco Schalkwijk
SQL Server MVP
<anonymous@.discussions.microsoft.com> wrote in message
news:216db01c45aac$4cc30320$a401280a@.phx.gbl...
> There is no web application connected (to my knowledge)
> and nothing is showing in the security logs.
> Using SQL Server 2000.
> Has been suggested that using Enterprise Manager and the
> DTS Import/Export Wizard to move objects could have caused
> the tables to be dropped? Any value in this theory?
>
> >--Original Message--
> >Check your web server logs, if there is web application
> connected. Check
> >your security logs...
> >
> >"Pegasus" <anonymous@.discussions.microsoft.com> wrote in
> message
> >news:212c301c45a9e$73c9e3c0$a301280a@.phx.gbl...
> >> I'm hoping someone out there can help me solve a
> mystery!
> >>
> >> 29 tables in our live database were deleted the other
> day
> >> and we've no real idea how this could have happened.
> >>
> >> We have found an entry in Application Event Viewer that
> >> happened at about the same time as the tables vanished,
> >> but we don't really understand what it means:
> >> EventID: 17055
> >> Categorey: (6)
> >> Description: 3041: BACKUP failed to complete the command
> >> dump tran [Claims] with no_log
> >>
> >> I understand that this is saying that the command
> failed,
> >> but where did the command come from? The user on the
> >> event was creating new tables and replacing stored
> >> procedures in the database at the time, however,
> [Claims]
> >> is the name of the whole database!
> >>
> >> We have recovered from the disaster now but really do
> need
> >> to understand what has happened here, how it happened,
> and
> >> how we can ensure it never happens again in the future.
> >>
> >> Thanks in advance for any help.
> >>
> >> Regards
> >>
> >> Paula
> >
> >
> >.
> >|||Hi,
There is only Copy objects option in DTS and this will just copy the objects
to destination.
What recovery model you are using for this database, If it is FULL or
Bulk_logged and if you have trasnaction logs you can use the Log explorer
tool to analyze the situation which caused the object drop.
www.lumigent.com
If you do not have the transaction log backup, it is very difficult to find
the cause for the object drop.
--
Thanks
Hari
MCDBA
<anonymous@.discussions.microsoft.com> wrote in message
news:216db01c45aac$4cc30320$a401280a@.phx.gbl...
> There is no web application connected (to my knowledge)
> and nothing is showing in the security logs.
> Using SQL Server 2000.
> Has been suggested that using Enterprise Manager and the
> DTS Import/Export Wizard to move objects could have caused
> the tables to be dropped? Any value in this theory?
>
> >--Original Message--
> >Check your web server logs, if there is web application
> connected. Check
> >your security logs...
> >
> >"Pegasus" <anonymous@.discussions.microsoft.com> wrote in
> message
> >news:212c301c45a9e$73c9e3c0$a301280a@.phx.gbl...
> >> I'm hoping someone out there can help me solve a
> mystery!
> >>
> >> 29 tables in our live database were deleted the other
> day
> >> and we've no real idea how this could have happened.
> >>
> >> We have found an entry in Application Event Viewer that
> >> happened at about the same time as the tables vanished,
> >> but we don't really understand what it means:
> >> EventID: 17055
> >> Categorey: (6)
> >> Description: 3041: BACKUP failed to complete the command
> >> dump tran [Claims] with no_log
> >>
> >> I understand that this is saying that the command
> failed,
> >> but where did the command come from? The user on the
> >> event was creating new tables and replacing stored
> >> procedures in the database at the time, however,
> [Claims]
> >> is the name of the whole database!
> >>
> >> We have recovered from the disaster now but really do
> need
> >> to understand what has happened here, how it happened,
> and
> >> how we can ensure it never happens again in the future.
> >>
> >> Thanks in advance for any help.
> >>
> >> Regards
> >>
> >> Paula
> >
> >
> >.
> >|||Thanks for your input. I have already got information
about LogExplorer from www.lumigent.com and we're looking
into purchasing this product for use in the future.
Unfortunately the log file no longer exists (don't ask!!!)
so this software would be of no use on this occasion. Is
there any other way forward on this?
Could the DTS Import/Export Wizard have caused this much
destruction by copying over 2 new tables and 3 existing
stored procedures from a development copy of the
database? The user insists that the objects were not
transferred to the live database using this Wizard. Even
if "dependant objects" was selected, could there be a
scenario where SQL would have dropped all tables
referenced in the SP's and all tables related to those
tables? If this is possible, can we disable the use of
DTS Import/Export wizard in Enterprise Manager for ALL
users?
>--Original Message--
>I'm hoping someone out there can help me solve a mystery!
>29 tables in our live database were deleted the other day
>and we've no real idea how this could have happened.
>We have found an entry in Application Event Viewer that
>happened at about the same time as the tables vanished,
>but we don't really understand what it means:
>EventID: 17055
>Categorey: (6)
>Description: 3041: BACKUP failed to complete the command
>dump tran [Claims] with no_log
>I understand that this is saying that the command failed,
>but where did the command come from? The user on the
>event was creating new tables and replacing stored
>procedures in the database at the time, however, [Claims]
>is the name of the whole database!
>We have recovered from the disaster now but really do
need
>to understand what has happened here, how it happened,
and
>how we can ensure it never happens again in the future.
>Thanks in advance for any help.
>Regards
>Paula
>.
>|||Thanks for your input.
No, we don't have the transaction log or a backup of it
(don't ask!!!) Is there another way to see what's
happened? There were 29 tables dropped in all so this
had very serious consequences and now we're trying to
ensure this doesn't happen again, but, without knowing
what DID happen we can't safeguard against it happening
again.
>--Original Message--
>Hi,
>There is only Copy objects option in DTS and this will
just copy the objects
>to destination.
>What recovery model you are using for this database, If
it is FULL or
>Bulk_logged and if you have trasnaction logs you can use
the Log explorer
>tool to analyze the situation which caused the object
drop.
>www.lumigent.com
>If you do not have the transaction log backup, it is very
difficult to find
>the cause for the object drop.
>--
>Thanks
>Hari
>MCDBA
><anonymous@.discussions.microsoft.com> wrote in message
>news:216db01c45aac$4cc30320$a401280a@.phx.gbl...
>> There is no web application connected (to my knowledge)
>> and nothing is showing in the security logs.
>> Using SQL Server 2000.
>> Has been suggested that using Enterprise Manager and the
>> DTS Import/Export Wizard to move objects could have
caused
>> the tables to be dropped? Any value in this theory?
>>
>> >--Original Message--
>> >Check your web server logs, if there is web application
>> connected. Check
>> >your security logs...
>> >
>> >"Pegasus" <anonymous@.discussions.microsoft.com> wrote
in
>> message
>> >news:212c301c45a9e$73c9e3c0$a301280a@.phx.gbl...
>> >> I'm hoping someone out there can help me solve a
>> mystery!
>> >>
>> >> 29 tables in our live database were deleted the other
>> day
>> >> and we've no real idea how this could have happened.
>> >>
>> >> We have found an entry in Application Event Viewer
that
>> >> happened at about the same time as the tables
vanished,
>> >> but we don't really understand what it means:
>> >> EventID: 17055
>> >> Categorey: (6)
>> >> Description: 3041: BACKUP failed to complete the
command
>> >> dump tran [Claims] with no_log
>> >>
>> >> I understand that this is saying that the command
>> failed,
>> >> but where did the command come from? The user on
the
>> >> event was creating new tables and replacing stored
>> >> procedures in the database at the time, however,
>> [Claims]
>> >> is the name of the whole database!
>> >>
>> >> We have recovered from the disaster now but really do
>> need
>> >> to understand what has happened here, how it
happened,
>> and
>> >> how we can ensure it never happens again in the
future.
>> >>
>> >> Thanks in advance for any help.
>> >>
>> >> Regards
>> >>
>> >> Paula
>> >
>> >
>> >.
>> >
>
>.
>