DBLense SQL Server Log Reader — User Guide
Read and analyze SQL Server transaction logs from online databases, .ldf log files, and backup files. Generate undo/redo recovery scripts, perform point-in-time analysis, and audit data changes with a visual timeline.
Overview
DBLense SQL Server Log Reader uses the undocumented fn_dblog and fn_dump_dblog functions to read transaction log records directly from SQL Server. This gives you visibility into every INSERT, UPDATE, DELETE, and DDL operation recorded in the transaction log.
The tool supports on-premises SQL Server 2016+ and Azure SQL Managed Instance.
Key Use Cases
- Data recovery — Recover accidentally deleted or modified rows by generating undo scripts from the transaction log
- Point-in-time analysis — Restore a table to a specific point in time by reverting all transactions after a target timestamp
- Forensic investigation — Determine who changed what data and when, with full transaction grouping and timeline visualization
- Change auditing — Track every DML operation with the responsible login, timestamp, and affected table
- Offline log analysis — Read .ldf log files or .bak backup files without attaching them to a SQL Server instance
- Disaster recovery planning — Generate recovery scripts proactively and export them for documentation
Getting Started
- Connect to SQL Server — Click the Connect button and enter your server details. Supports Windows, SQL, and Azure Entra ID authentication.
- Select a Database — Choose the database whose transaction log you want to read from the database dropdown.
- Choose Log Source — Select “Online Database” to read the active transaction log, or “Log/Backup File” to read an offline .ldf or .bak file.
- Read Log — Click Read Log to begin reading. Log entries appear in the Log Entries tab with automatic transaction grouping.
Log Sources
| Source | Function | Description |
|---|---|---|
| Online Database | fn_dblog(NULL, NULL) | Reads the active transaction log of the selected database. Shows only uncommitted and recent committed transactions still in the log. |
| Log File (.ldf) | fn_dump_dblog | Reads a detached transaction log file. Requires sysadmin privileges. The file path must be accessible to the SQL Server service account. |
| Backup File (.bak) | fn_dump_dblog | Reads transaction log records from a full or log backup. Useful for analyzing historical changes from backup files. |
Log Entries Tab
The primary view showing individual log records:
- Statistics bar — Shows total entries, insert count, update count, delete count, and total data size
- Operation filters — Quick checkboxes to show/hide Inserts, Updates, Deletes, and DDL operations
- DataGrid columns — Row #, LSN, Transaction ID, Operation (color-coded), Category, Table, Schema, Login, Begin Time, Transaction Name, Size, Description
- Search bar — Filter by table name, login name, or transaction ID
Operation Color Coding
| Operation | Color | Examples |
|---|---|---|
| INSERT | Green | LOP_INSERT_ROWS |
| UPDATE | Orange | LOP_MODIFY_ROW, LOP_MODIFY_COLUMNS |
| DELETE | Red | LOP_DELETE_ROWS |
| DDL | Blue | LOP_CREATE_TABLE, LOP_ALTER_TABLE |
Transactions Tab
Groups log entries by transaction for a higher-level view:
- Transaction grid — Transaction ID, Login, Status (Committed/Rolled Back/Active), Begin/End Time, Duration, Insert/Update/Delete counts, Affected Tables
- Detail panel — Select a transaction to see all its individual log entries in a detail grid below (with a resizable GridSplitter)
- Undo/Redo buttons — Generate undo or redo scripts directly from a selected transaction
Timeline Tab
Visual timeline of transaction activity:
- Timeline grid — Time, Transaction ID, Login, Operations count, Affected Tables, and Alert indicator
- Alert detection — Automatic “⚠” warning for mass deletes (100+ rows) and unusually large transactions (1000+ operations)
- Alert messages — Descriptive text explaining why each alert was triggered
Recovery Tab
Generate and export recovery scripts:
Point-in-Time Recovery
Enter a target date/time and table name to generate a recovery script that undoes all committed transactions after that point. The generated script includes:
- Transaction wrapper with BEGIN TRY / BEGIN CATCH
- Reverse-order DML operations (DELETE for INSERTs, UPDATE for UPDATEs, INSERT for DELETEs)
- Summary comments with transaction count and operation count
Transaction Recovery
Select a transaction from the dropdown and generate an Undo script (reverse the transaction) or Redo script (replay the transaction).
Export Buttons
- Export CSV — Export log entries to CSV format
- Export Transactions CSV — Export transaction summary to CSV
- Export SQL Script — Save the generated recovery script to a .sql file
- Export HTML Report — Generate a dark-themed HTML report with summary statistics and entry tables
Filtering
| Filter | Description |
|---|---|
| Time Range | From/To date pickers to narrow log entries by time window |
| Table Name | Show only entries affecting a specific table |
| Login Name | Show only entries from a specific login |
| Transaction ID | Show only entries belonging to a specific transaction |
| Operation Types | Toggle Inserts, Updates, Deletes, and DDL operations on/off |
| Search Text | Free-text search across all log entry fields |
Export Options
| Format | Description |
|---|---|
| CSV | Comma-separated values with all log entry columns. Opens in Excel, Google Sheets, etc. |
| SQL Script | T-SQL recovery script (.sql file) with undo/redo/point-in-time operations |
| HTML Report | Dark-themed HTML report with summary cards and detailed entry/transaction tables. Capped at 5,000 rows for performance. |
Command-Line Arguments
DBLenseLogReader.exe [-s server] [-u user] [-p password] [-e]| Arg | Description |
|---|---|
-s, --server | SQL Server name to connect to on startup |
-u, --user | SQL login username (implies SQL Auth) |
-p, --password | SQL login password |
-e | Use Windows Authentication (default) |
Troubleshooting
| Issue | Solution |
|---|---|
| "fn_dblog access denied" | Ensure you have VIEW SERVER STATE permission. Some environments require sysadmin. |
| "fn_dump_dblog failed" | Requires sysadmin role. Verify the file path is accessible to the SQL Server service account. |
| No log entries returned | The transaction log may have been truncated. Active transactions and recent committed transactions are visible in SIMPLE recovery model; switch to FULL recovery model for complete history. |
| Empty table/login columns | Some log operations (e.g., LOP_BEGIN_XACT, LOP_COMMIT_XACT) don’t have associated table or login metadata. |
| Large log takes long to read | Use time-range filters before reading to limit the scope. The progress bar shows reading status. |
| Recovery script errors | Review the generated script before executing. Table or column changes since the logged operation may require manual adjustments. |
System Requirements
| Component | Requirement |
|---|---|
| OS | Windows 10/11 or Windows Server 2016+ |
| Runtime | .NET 8.0 (or self-contained package) |
| SQL Server | SQL Server 2016+ (for fn_dblog / fn_dump_dblog) |
| Azure | Azure SQL Managed Instance (online log only) |
| Permissions | VIEW SERVER STATE (online log), sysadmin (offline files via fn_dump_dblog) |
| Recovery Model | FULL recommended for comprehensive log history |
| Installation | None — single portable .exe |