Sql-server – Find if and when a Query was run

auditsql serversql server 2014

I am trying to get to the root of a problem and need to see if and when a specific Delete Query was run on my MS SQL Server.
The command would have come from my .NET website.

My Server is Windows 2012 R2 running SQL 2014 Express.

The query would have run at some point in the last 3 weeks or so.

Best Answer

In a database where SQL Server Audit was not previously configured you could try to Read SQL Server Transaction Log Backups to Find When Transactions Occurred with the use of the undocumented function fn_dump_dblog.

For future situations where you need to audit a database I advise you to Create a server audit and database audit specification.

Unfortunately, based on your comment

all I have is whatever is built-in by default

I'd say you have no means to find the info you seek and the reason is that, by default, a new database you create on a SQL Server Express uses the Simple Recovery Model, which doesn't allow taking log backups. Therefore, the function I mentioned will not help.

Related Question