Interface & Features — Log Reader

Walk through the main screens, tabs, and controls you will use day to day.

Log Entries Tab

This is the main grid. Every row represents a single log record. Rows are sorted newest first by default.

Toolbar

• Export CSV — Export the currently displayed rows to a CSV file.
• Clear — Clear all loaded data.
• Statistics bar — Shows Total entries loaded, Insert (I), Update (U), Delete (D) counts, and total log size.
• Operation checkboxes — Toggle Insert, Update, Delete, DDL, and Transaction boundary rows on or off instantly without re-reading the log.
• Search box — Type to filter by table name, login, transaction ID, operation, or description. Press Search or hit Enter.
• Apply / Reset — Apply the current duration/date filter or reset all filters to defaults.

Grid Columns

Operation Color Coding

Tip: Click any DML row to load its row-level undo/redo scripts in the panel below the grid. Click the pink document icon on a DML row to open the Data Changes popup (before/after values + hex view).

Row-Level Scripts Panel

When you click a log entry in the grid, the panel at the bottom of the Log Entries tab shows scripts for that individual row:

• Undo Script tab — T-SQL to reverse this specific operation. For an INSERT this is a DELETE; for a DELETE this is an INSERT; for an UPDATE this restores the original values.
• Redo Script tab — T-SQL to replay this operation as it originally happened.
• Copy Undo / Copy Redo — Copy the script to clipboard for immediate use in SSMS.

Scripts are only available for INSERT, UPDATE, and DELETE rows. Selecting a transaction boundary row (BEGIN TRAN / COMMIT) or a DDL row shows an explanatory message instead of a script. For DDL recovery, use the Recovery Tab.

Where possible, UPDATE scripts use %%physloc%% live-row lookup to recover primary keys and unchanged columns that the log alone does not contain. Review any lookup warnings in the generated script before executing.

Data Changes Popup

Click the pink document icon on a DML row in Log Entries to open a popup with decoded before/after values:

• Column name, data type, old value, new value, and a changed (Δ) marker
• Hex / binary dump of the underlying log record for forensic review
• Useful for verifying exactly what data was modified before generating an undo script

Note: Column decoding works best when the table still exists with a compatible schema. If the table was dropped or columns were renamed/removed, decoding may be partial or unavailable.

Transactions Tab

Groups log entries into logical transactions — a higher-level view showing what each unit of work did as a whole.

Transaction Grid Columns

Transaction Entries Detail Panel

Click a transaction row to expand the detail panel at the bottom. This shows every individual log record belonging to that transaction, including the BEGIN TRAN and COMMIT rows.

Undo & Redo Buttons

• Undo (Rollback) — Generates a T-SQL script that reverses all DML operations in the selected transaction in reverse order. The script is written to the Recovery Tab.
• Redo (Replay) — Generates a T-SQL script that replays all DML operations in the selected transaction in original order.

Transaction Isolation

You can isolate one or more transactions to generate a combined recovery script:

1. Select a transaction and click Isolate Selected. Repeat for additional transactions.
2. The N isolated counter shows how many are queued.
3. Click Generate Undo for Isolated to produce a single combined undo script covering all isolated transactions.
4. Click Clear All to reset the isolation queue.

Recovery Tab

The Recovery tab is where you generate, view, and export recovery scripts.

Point-in-Time Recovery

Use this to roll a specific table back to a point in time:

1. Select the Table from the dropdown (watermark: Select a table…; populated from loaded log entries).
2. Set the target Date and Time.
3. Click Generate PIT Script.

The tool finds committed transactions on that table whose commit time is after your target, then emits real undo T-SQL for each DML row (same decode path as transaction undo). The script is wrapped in BEGIN TRY / BEGIN CATCH. Always review in SSMS before executing.

Tip: PIT uses the full loaded transaction set (not only the filtered Transactions grid), so narrowing UI filters does not silently omit recovery candidates.

Transaction Recovery (Undo / Redo)

Select a transaction from the Transactions tab and click Undo or Redo — the script appears here automatically. For DML transactions (INSERT/UPDATE/DELETE), the script includes reverse or replay statements built from decoded row images. Isolation undo (multiple selected transactions) uses the same path.

DDL Transactions

When you select a DDL transaction (CREATE TABLE, ALTER TABLE, DROP TABLE, TRUNCATE) and click Undo, the Recovery tab shows a diagnostic block instead of executable DML — because SQL Server’s transaction log does not store the original DDL text in a decodable form. The diagnostic block includes:

• The DDL operation type (e.g., CREATE TABLE)
• A ready-to-run SQL query to identify which object was affected at that timestamp
• The appropriate manual reversal hint (e.g., DROP TABLE [schema].[tableName] to undo a CREATE)

See DDL in the Log for a full explanation.

Export Buttons

• Export SQL Script — Save the generated recovery script as a .sql file.
• Export Log as CSV — Export all loaded log entries to CSV.
• Export Transactions CSV — Export the transaction summary to CSV.
• Export HTML Report — Generate a dark-themed HTML report with summary statistics, log entry table, and transaction table for sharing or archiving (capped at 5,000 rows; you are warned if truncated).

Analysis Tab

The Analysis tab groups three investigative views in one place (sub-tabs):

• Summary — Counts and breakdowns for the loaded window
• Timeline — Chronological DML transactions with ⚠ alert flags
• Row History — Lifecycle of individual rows by table / key

Timeline & Alerts

Under Analysis → Timeline, each DML-bearing transaction appears in time order so you can scan activity quickly. An info icon (🛈) in the header and a blue banner explain the alert rules.

Grid columns

Alert / risky flags

Alerts are heuristics for review — they do not auto-recover or block anything. They help you spot risky patterns fast:

If both conditions could apply, the Timeline prefers the mass-delete message when deletes exceed 100; otherwise it shows the large-transaction message.

Timeline respects the same duration / date / table / login filters as Log Entries. Click Apply after changing filters to refresh Timeline with the rest of the UI.

Summary

Under Analysis → Summary, a statistical overview of the loaded log data:

• Total log entries, total transactions, and DML operation counts (Insert / Update / Delete / DDL)
• First and last entry timestamps covering the loaded window
• Total log data size
• Per-table breakdown of operations (how many inserts, updates, deletes per table)
• Per-login breakdown (which logins made how many changes)

Note: Summary statistics are computed from all entries read in the current session, not just the currently filtered view.

Row History

Under Analysis → Row History, track the full change history of individual rows across loaded transactions:

• Rows are grouped by table and primary key value.
• Each row history chain shows every INSERT, UPDATE, and DELETE that touched that specific record, in chronological order.
• Use this to reconstruct the complete lifecycle of a record — from creation to deletion.
• Select a history chain on the left to see the individual change events on the right with timestamps and login names.

Row history chains are built from all entries loaded in the current session.

Monitor Tab

Polls the live database transaction log at regular intervals and shows new entries as they arrive — like a live tail of the SQL Server log.

How to use it

1. Connect to a database and click Read Log at least once to establish a baseline LSN (the starting point for monitoring).
2. Switch to the Monitor tab and click Start Monitoring.
3. New log entries appear in the Monitor grid in real time. The status bar shows how many new entries have been detected.
4. Click Stop Monitoring to pause.

Monitor interval

The default poll interval is configurable. A shorter interval gives more real-time visibility but increases SQL Server load. For busy databases, 5–10 seconds is a good starting point.

What Monitor refreshes

Each poll appends new entries and rebuilds Transactions, Timeline, and Summary from the combined set so Analysis stays in sync. New rows also appear in Log Entries subject to active filters (duration, search, operation type checkboxes).

Clearing the file source returns the tool to online-database mode for monitoring.

Filtering

All filters are applied to the Log Entries, Transactions, and Analysis → Timeline views simultaneously. You do not need to re-read the log after changing filters — the data is re-filtered in memory.

Reset restores all filters to their defaults (Last 1 Hour, all operation types visible, no text search).

Export Options