1. Introduction
Log Explorer is mainly used for transaction analysis and data recovery of MSSQLServer. You can browse logs, export data, and restore modified or deleted data (including tables that have executed update, delete, drop, and truncate statements). Once data is lost due to system failure or human factors, it can provide online and fast data recovery, ensuring uninterrupted execution of other things during the recovery period to the greatest extent.
He can support SQLServer7.0 and SQLServer2000, extract the information in the log file or backup file of the standard database.
Which provides two powerful tools: log analysis browsing, object recovery. The specific functions are as follows:
- log file browsing
- Database Change Review
- Plan and Authorization Change Review
- Export log records to a file or database table
- Monitor database transactions in real time
- Calculate and count loads
- Recover data by selectively undoing or redoing things
- Recover data from truncated or deleted tables
- Run SQL scripts
2. Installation
LogExplore consists of two parts:
- Client software
- server proxy
The server-side proxy is a read-only stored procedure stored in the SQL Server host. Its function is to accept client requests, read online transaction log blocks, and transmit them to the client software through the network. The client software reads these original data blocks to perform all the functions provided by Log Explore.
The network protocols he relies on include:
- Named Pipe: Applicable in LAN
- Tcp/Ip: Applicable in WAN
This software is in C/S mode, the server is installed on the MSSQL server, and the client can be installed where needed.
3. Instructions for use
3.1 Connect to the database
Double-click Log Explore, the software interface that appears
Click Attach Log File in the upper left box to enter the connection database interface
Notice:
Select the database name you want to view, and choose whether to use the online log or the backup file for analysis.
After successfully connecting to the database, a warning will appear, press OK.
3.2 Function description
Log Summary：
Summary information for the log file.
Load Analysis：
List some transactions, users and table loading summary information for the specified time range.
Filter Log Record：
Log filtering settings. Supported filter conditions include: Time, Operation Type, Table, User, SPID, Search Depth, Dropped Table Items, and Login Settings and Application Settings
Browse：
Log browsing, the core module.
- View Log function:
The list is shown in the figure, you can use TransID to distinguish things and identify them with different colors. The buttons of the toolbar are some basic query operations. There are Undo Transaction and UndoOperation in the pop-up menu of the right mouse button to restore the thing or operation item selected by the black arrow. - Real-Time Monitor: Real-
time monitoring of transaction logs, implemented by polling. Monitoring can be paused or stopped, and the polling period can be changed. - Related DML and DDL languages can be queried in Row Revision History, Row Transaction History and View DDL Commands.
Export Log Records:
- Export to SQL
Export data from log and restore to table in SQL database
- Export to Files
Export data from logs and save as xml, html or character split files
Recovery: Undo User Transactions ：
Allows to undo a selected set of transactions, for example: undo deletion or modification of data due to user or application error.
Recovery: Redo User Transactions：
Allows you to redo a series of transactions of your choice.
Salvage Dropped/Truncated Data：
Allows you to restore some or all of the data for a dropped or truncate table
Restore Table from Backup：
Restoring table data using backups
Run SQL Script：
Allows you to execute SQL commands stored in script files.
Exit：
Exit Log Explorer
Four, data recovery example
4.1 Accidental deletion of data
As shown in the figure, the simulated data is deleted by mistake. The test environment is to delete 2 rows of data in the test table in the test database.
4.2 Transaction lookup
With Log Explorer, find the transaction log for data deletion operations. As shown in the figure: We see the operation of the two DELETE_ROWS in the test table just now on the View Log, that is to say, the two rows of data with data 4 and 5 in the name column have been deleted.
4.3 Data Recovery
Right-click the transaction operation to be restored and select Undo Transaction
Then there will be a save box to roll back the file, the text content is the SQL statement to be restored.
Copy the contents of the Recovery1.sql file to the query analyzer for execution to complete the recovery operation
Five, database related introduction
5.1 Transaction Log
Each database in SQL Server contains a transaction log, which is stored in the form of a file that records any changes to the database. SQL Server is used to ensure data integrity in the event of a failure.
5.2 Operation
Operations are "atomic behaviors" defined in the database, and each operation is saved as a record in the log file. It can be an SQL statement directly input by the user, such as a standard insert command, and an operation code will be recorded in the log file to mark the insert operation.
5.3 Transactions
A thing is a sequence of operations. It can be understood as an intuitive and inseparable piece of business, which can be executed successfully or failed. A typical thing is a set of SQL statements with an open-commit function issued by an application. Different things are distinguished by transaction ID, and transactions with the same ID record the same log.
5.4 Online Transaction Log
The online transaction log refers to the log used by the currently active database. The corresponding file can be determined by the following command:
Select * from SYSFILES
His file suffix is generally .LDF
5.5 Offline Transaction Log
The offline transaction log refers to the log used by the inactive database. When the database is in the ShutDown state, the replication backup operation can be performed. His results were identical to the online transaction log.
5.6 Backup files
A backup file is a file that holds a backup of the food log, usually an administrator generates this file by running a SQL statement or Enterprise Manager. The internal structure of the backup file is different from the transaction log, and it uses a format called MTF to save the data. A backup file can contain multiple sets of backups of a log, or even mixed backups of multiple databases.
5.7 Set to auto shrink
Enterprise Manager--Server--Right-click Database--Properties--Options--Select "Auto Shrink"
It is strongly recommended that this item be unchecked. Otherwise, SQL Server will overwrite the previous log records in a circular manner, which will cause LogExplore to fail to recover errors.
5.8 Introduction to Data Recovery
LogExplore allows you to recover data lost or changed due to misoperation or program error. For example, when executing update\Delete statement, missing where clause, or wrongly using Dts function.
LogExplore does not support directly modifying the database. It can generate reverse scripts for things.
If log is delete table where ..., the generated file code is insert table ....
You can execute the generated script through SQL Query Analyzer, or LogExplore's Run SQL Script function.
5.9 About Undo
The Undo function can reverse a set of specified user things. Including insert, delete and update, the limitations are as follows:
- Thing category: LogExplore can only undo user things. User things refer to the things defined on the user table, and do not support the update and recovery of the system table. At the same time, it does not support rollback of planned changes.
- Blob type: including text, ntext, image types. LogExplore only supports these types of insert and delete recovery, not update statement recovery.
5.10 About redo
The Redo function can run a specified set of things again. It can be used in the following situations:
Lost database without any backup files.
- Redo can be used to recover if the original log file is not lost.
- Restore the database to a specified point in time through a complete backup file, and then restore it completely through the redo function. It can replay Create Table and Create Index commands to regenerate dropped tables, and is also limited by blob fields.
5.11 SQL Inverse Operations
1、Insert--Delete
2、Delete--Insert
3、Update
| Column1 |
Column2 |
| A |
B |
thing 1
| Column1 |
Column2 |
| X |
B |
thing 2
| Column1 |
Column2 |
| WITH |
T |
You can just do the inverse of thing 1
| Column1 |
Column2 |
| A |
T |
Note: If you check the 'Do not restore column values that have been changed by subsequent modifications' option, reversing only thing 1 will not produce any results.
5.12 Rescue data loss caused by Dropped/Truncate command
Although executing the Drop Table and Truncate Table commands will be recorded in the log file by SQL Server, the deleted data will not be recorded. You can use the functions provided by LogExplore to recover this data. LogExplore provides two mechanisms to recover data that has been dropped or truncated.
1. If you have a backup file, you can restore it directly through the backup file.
2. Recover through the method provided by LogExplore.
When the above command is executed, SQL Server will put the page holding the data into the free page list. The original data will always be saved if the page is not used again. When recovering, LogExplore will search the free page list for pages that are not being used again, and then generate an SQL script to reconstruct the original data from these pages. LogExplore can determine the original data rows that have been deleted, and display the original number of rows and the number of rows actually recovered when it is completed, so that it can be concluded whether all the rows have been recovered.
Reprinted from: https://blog.csdn.net/hch271510994/article/details/54091321