Yesterday one of my team members has truncated a few tables, but who have truncated those tables is still a mystery.
Can I have user based query log with the timing of execution? Or something where I can enable that functionality in future??
Currently, I am using SQL-Server 2017 on Linux.
Thank you in advance.
Best Answer
Yes, we had a similar issue as well--for payroll data! Try the default trace as shown in this blog (it appears that this is available for Linux as well):
https://social.msdn.microsoft.com/Forums/sqlserver/en-US/80938ab2-28a4-46eb-8b09-84ab9ae22079/how-to-find-the-user-who-performed-a-truncate-statement?forum=transactsql
Linux default trace location:
http://www.dharmendrakeshari.com/main-file-directory-structure-sql-server-linux/