Documentation / Log Reader / Overview

DBLense SQL Server Log Reader — User Guide

Read and analyze SQL Server transaction logs from live databases, .ldf log files, and backup files. See every INSERT, UPDATE, DELETE, and DDL operation. Generate undo/redo recovery scripts, perform point-in-time analysis, and monitor changes in real time.

Log Reader is for after something changed in the database: who updated a row, what was deleted, and how to undo or redo it from the transaction log — without restoring an entire backup when a surgical fix is enough.

Overview

DBLense Log Reader connects to SQL Server and reads the transaction log using the built-in fn_dblog function (live database) or fn_dump_dblog (offline files). Every committed and active transaction is decoded into a human-readable grid — no SQL expertise required.

The tool is a single portable .exe file, no installation needed. It supports SQL Server 2016+ on-premises and Azure SQL Managed Instance.

Key Use Cases

  • Recover accidentally deleted rows — Find the DELETE transaction in the log, generate an undo script, and replay the original INSERT to get the data back.
  • Undo a bad UPDATE — Locate the UPDATE, open the Data Changes popup for before/after values, and generate a script to restore the original values.
  • Point-in-time table restore — Roll back a table to any point in time by undoing all committed transactions after your target timestamp.
  • Forensic investigation — Find out who deleted records and exactly when. The Log Entries tab shows the SQL login, time, and affected table for every operation.
  • Detect mass deletes & large txs — Analysis → Timeline flags mass deletes (100+ DELETEs) and large transactions (1,000+ DML ops) with ⚠ alerts.
  • Audit DDL changes — See CREATE TABLE, ALTER TABLE, and DROP TABLE events with the responsible login and timestamp.
  • Analyze offline log files — Read detached .ldf files or .bak backup files to investigate historical changes without attaching them to a running instance.
  • Monitor in real time — The Monitor tab polls for new log entries every few seconds and shows them as they arrive.