Hi,
Someone has update the master table with wrong data, In order to find the person who commited the wrong output, I have used the Transaction Log Backup file and read the file using sys.fn_dblog.
Now the output looks like below:
| UserName | Current LSN | Transaction ID | Operation | Transaction Name | CONTEXT | AllocUnitName | Page ID | Slot ID | Begin Time | End Time | Number of Locks | Lock Information |
| NULL | 000b136d:001bd2b8:015c | 0001:2517521c | LOP_MODIFY_ROW | NULL | LCX_PFS | dbo.tblLocMst.IX_missing_tblLocMst | 0003:00000001 | 0 | NULL | NULL | 0 |
After this, I have executed the below code to identify the User Name etc..
SELECT
Operation,
[Transaction ID],
[Begin Time],
[Transaction Name],
[Transaction SID],
SUSER_SNAME([Transaction SID]) as UserName
FROM
fn_dblog(NULL, NULL)
WHERE
[Transaction ID] = '0001:25177f5e'
AND
[Operation] = 'LOP_BEGIN_XACT'
This code returns the Database User (SA in my case) who executed this wrong update command, Is there any way i can find the IP address or Host name of the person who done this wrong update.
Appreciate,
Thanks and regards,
Sheetal.