2

I have a website with MySQL database. Someone deleted 1,000 records from a table. Is there any way to find out who have deleted the records and when from the website? And from where the records were deleted: from website or from phpmyadmin?

It will be great if anyone can help me.

Khaled
  • 36,533
  • 8
  • 72
  • 99
Jagat Sheth
  • 71
  • 1
  • 5

2 Answers2

2

Unless you had the general query log enabled while this happened, no, that information is lost.

adaptr
  • 16,576
  • 23
  • 34
2

If have already enabled mysql logging, you can just look at the log file. You can find every executed query and you can know the user and IP address of the client.

The logging can be enabled in the config file /etc/mysql/my.cnf:

general_log_file        = /var/log/mysql/mysql.log

If the log file is empty and the log file line is commented, then you don't have the log enabled. AFAIK, you can NOT find such information in this case (no logging).

Khaled
  • 36,533
  • 8
  • 72
  • 99
  • That does not tell me where in my.cnf this needs to go. Also, the IP address is useless for local connections: both a local web site and phpmyadmin (which is also a web site) use the same local Unix socket. – adaptr Mar 20 '12 at 13:59
  • This is not stated in the OP question. Even though, it still can be considered a general note :) – Khaled Mar 20 '12 at 14:59
  • My server is windows 2008 server. Please let me know what setting I have to enable and check to enable logging. And also please let me know if the setting not enable is there any way to find who have done the operation on perticular DB. – Jagat Sheth Mar 21 '12 at 04:54