Audit whether stored proc was executed - in the transaction logs

Question

We have SQL Server 2005 database with full backup and transaction logs. We have a problem with the database - and need the SQL CSI Forensic team to help.

Is there a way to look at the transaction logs and identify whether a stored procedure was executed? We know the time that it happened (if it happened) but there is a dispute whether it happened.

Any suggestions. I know we should have been logging - we are obviously thinking about this now.

Answer 1

For updating & deleting data you may be able to figure out what happened using DBCC LOGINFO There are products like apex sql log that will make this analysis much easier. THis will tell you when it happened, but not what user made the call. Although you make have other application level logs (iis logs for example) that may help in this respect.

For selecting or looking at data i'd say you have no chance.

In future if you need this kind of audit trail i suggest you look at SQL's C2 Auditing feature.

Answer 2

There used to be a company called Lumigent that had a program called Log Explorer. I couldn't find the companies web site...and I am not sure if theyr explorer would be able to tell you if a proc was executed...however it would tell you if the statements insite the proc were executed at the time you think they were. If you could find it, Lumigent Log Explorer would probably help.