Documentation / Log Reader / Overview

DBLense SQL Server Log Reader — User Guide

Read and analyze SQL Server transaction logs from live databases, .ldf log files, and backup files. See every INSERT, UPDATE, DELETE, and DDL operation. Generate undo/redo recovery scripts, perform point-in-time analysis, and monitor changes in real time.

Log Reader is for after something changed in the database: who updated a row, what was deleted, and how to undo or redo it from the transaction log — without restoring an entire backup when a surgical fix is enough.
Please read the limits. Scripts are drafted from the log, not from the original T-SQL. DDL (especially DROP TABLE) cannot be reversed automatically. See Limitations and Undo / Redo script limits.

Overview

DBLense Log Reader connects to SQL Server and reads the transaction log using the built-in fn_dblog function (live database) or fn_dump_dblog (offline files). Every committed and active transaction is decoded into a human-readable grid — no SQL expertise required.

The tool is a single portable .exe file, no installation needed. It supports SQL Server 2016+ on-premises and Azure SQL Managed Instance. A license is per user, not per SQL Server instance. Light and Dark themes are on the left sidebar.

DBLense Log Reader after Read Log: saved local connection, AdventureWorks2022, Log Entries grid filtered to Probe, with operation colors and status counts

What the tool does

  • Read four log sources — pick Online database, Transaction log (.ldf), Full backup (.bak), or Log backup (.trn) in the Source combo, then Browse when a file is needed.
  • Decode DML — INSERT, UPDATE, and DELETE rows with table, schema, login, time, LSN, and transaction ID.
  • Show DDL events — CREATE / ALTER / DROP TABLE and TRUNCATE as they appear in the log (not the original T-SQL text).
  • Row-level undo and redo — click a DML row; copy, export, or Open in editor (SSMS / default .sql app). The tool does not execute the script.
  • Before / After — boxed button on each DML row opens decoded old and new column values plus a hex dump.
  • Transaction Recovery — undo or redo an entire transaction (or several isolated transactions) from the Transactions tab. The properties pane shows LSNs, SID, tables, and duration for the selected transaction.
  • Point-in-Time Recovery — generate undo SQL for one table after a chosen timestamp, using schema.table (not a bare table name).
  • Analysis — Summary counts, Timeline with mass-delete / large-txn / open / long-running flags, and Row History by table and key.
  • Monitor Active log — live poll dialog (Start / Stop, then Close).
  • Export — log CSV, transactions CSV, Excel (SpreadsheetML .xls), recovery .sql, and an HTML report (capped at 5,000 rows).
  • Save / open investigation — File menu stores source, filters, and LSN in JSON. Opening it restores filters; you still click Read Log.

Main tabs vs dialogs

The window has three main tabs. Recovery and Monitor are not extra tabs:

  • Log Entries — the grid, filters, row undo/redo, Before / After, and the Point-in-Time Recovery side panel.
  • Transactions — grouped units of work, isolate several txns, Transaction Recovery side panel.
  • Analysis — Summary, Timeline, and Row History sub-tabs.

Monitor Active log opens its own dialog from the toolbar. Help → About is the license, trial, and terms window.

Key Use Cases

  • Recover accidentally deleted rows — Find the DELETE transaction in the log, generate an undo script, and replay the original INSERT to get the data back.
  • Undo a bad UPDATE — Locate the UPDATE, open the Data Changes popup for before/after values, and generate a script to restore the original values.
  • Point-in-time table restore — Roll back a table to any point in time by undoing all committed transactions after your target timestamp.
  • Forensic investigation — Find out who deleted records and exactly when. The Log Entries tab shows the SQL login, time, and affected table for every operation.
  • Detect mass deletes, large txs, open, and long-running work — Transactions and Analysis → Timeline flag mass deletes (100+ DELETEs), large transactions (1,000+ DML ops), still-Active (open) transactions, and committed work that ran 60 seconds or longer.
  • Audit DDL changes — See CREATE TABLE, ALTER TABLE, and DROP TABLE events with the responsible login and timestamp.
  • Analyze offline log files — Read detached .ldf files or .bak backup files to investigate historical changes without attaching them to a running instance.
  • Monitor in real time — The Monitor Active log button opens a dialog that polls for new log entries every few seconds and shows them as they arrive. The same table, login, and time filters as Log Entries are available there.

For what the log cannot reconstruct, see Limitations and Undo / Redo script limits.