i have issue in our database(as400- db2) in 1 of our tables rows deleted. not know if program or sql user executed. know hapend +- 3am in morning. did check scheduled jobs @ time.
we managed data backups want investigate deleted records or user.
are there logs on die as400 on physical tables check sql executed , when on specified table? me determine caused this.
i tried checking systems navigator not find logs... there way of getting transnational data on table using system navigator or green screen? , if can sql executed in timeline.
any appreciated.
there no mention of how time inferred\determined, lack of journaling, suggest approach gather information file , member; dspobjd both *service , *full, dspfd *all, dmpobj, , perhaps copy of row table catalog [to include last_altered_timestamp alteredts column of systables or based-on field dbxats qadbxref]. gathering those, worthwhile if done before other activity [esp. before recovery activity], can establish time of event , perhaps allude event; timestamps reflective of of recent activity against object [rather historical log], recovery activity effect loss of timestamps reflective of prior event\activity.
even if there no journal file , nothing in plan cache, there may have been [albeit unlikely] active sql monitor. active monitor should available visible somewhere in inav gui well. not sure of visibility of monitor may have been active in prior time-frame.
similarly despite lack of journaling, there may system-level object or user auditing in effect event tracked either command-string or action on file.member; combined inferred timing, audit records spanning before until after can reviewed.
although there may have been nothing in scheduled jobs, history log (dsplog) since time may show jobs ended, or [perhaps soon] prior time show jobs started, more have been responsible. in experience, name of job may indicative; example name of job name of file, perhaps due request having been submitted pdm. spooled [or otherwise still available] joblogs reviewed possible reference file and\or member name; perhaps completion message clrpfm request.
if action may have been program, file may recorded reference-object such output dsppgmref may reveal programs reference, , [service] program sql program have embedded sql statements revealed prtsqlinf; last-used programs reviewed possible matches. note: module , program sources can searched, there no way know name compiled or may have been bound if created temporarily purpose of binding.
