Interface & Features — Log Reader

Walk through the main screens, tabs, and controls you will use day to day.

Log Entries Tab

This is the main grid. Every row represents a single log record. Rows are sorted newest first by default.

Toolbar

• Source — Online database, transaction log (.ldf), full backup (.bak), or log backup (.trn). Browse picks a file for the last three. Switching back to Online clears the file.
• Export — CSV, Excel (SpreadsheetML .xls), HTML report, or recovery SQL from File or the Export ▾ menus.
• Clear — Clear all loaded data.
• Statistics bar — Shows Total entries loaded, Insert (I), Update (U), Delete (D) counts, and total log size.
• Operation checkboxes — Toggle Insert, Update, Delete, DDL, and Transaction boundary rows on or off instantly without re-reading the log.
• Search box — Type to filter by table name, login, transaction ID, LSN, operation, or description. Press Search or hit Enter.
• Apply / Reset — Apply the current duration/date/LSN filter or reset all filters to defaults.

Grid Columns

Operation Color Coding

Tip: Click any DML row to load its row-level undo/redo scripts in the panel below the grid. Click the boxed Before / After button (document icon with a border and background, tooltip Open Before / After data changes) on a DML row to open the Data Changes popup.

Row-Level Scripts Panel

When you click a log entry in the grid, the panel at the bottom of the Log Entries tab shows scripts for that individual row:

• Undo Script tab — T-SQL to reverse this specific operation. For an INSERT this is a DELETE; for a DELETE this is an INSERT; for an UPDATE this restores the original values.
• Redo Script tab — T-SQL to replay this operation as it originally happened.
• Copy Undo / Copy Redo — Copy the script to clipboard for immediate use in SSMS.
• Open in editor — Writes a temp .sql file and opens it in SSMS or whatever app handles .sql on this machine. Log Reader does not execute the script.

Scripts are only available for INSERT, UPDATE, and DELETE rows. Selecting a transaction boundary row (BEGIN TRAN / COMMIT) or a DDL row shows an explanatory message instead of a script. For table-level recovery, use Point-in-Time Recovery on the Log Entries page. For a whole transaction, use Transaction Recovery.

Where possible, UPDATE scripts use %%physloc%% live-row lookup to recover primary keys and unchanged columns that the log alone does not contain. Review any lookup warnings in the generated script before executing.

Data Changes Popup

Click the boxed Before / After button on a DML row in Log Entries to open a popup with decoded before/after values:

• Column name, data type, old value, new value, and a changed (Δ) marker
• Hex / binary dump of the underlying log record for forensic review
• Useful for verifying exactly what data was modified before generating an undo script

Note: Column decoding works best when the table still exists with a compatible schema. If the table was dropped or columns were renamed/removed, decoding may be partial or unavailable.

Transactions Tab

Groups log entries into logical transactions — a higher-level view showing what each unit of work did as a whole. Select a row to fill the Transaction properties pane on the right (ID, name, login, SID, status, begin/end, duration, begin/end LSN, tables, DML counts, and alert reason).

Transaction Grid Columns

Transaction Entries Detail Panel

Click a transaction row to expand the detail panel at the bottom. This shows every individual log record belonging to that transaction, including the BEGIN TRAN and COMMIT rows. Affected tables are listed as schema.table.

Undo & Redo Buttons

• Undo (Rollback) — Generates a T-SQL script that reverses all DML operations in the selected transaction in reverse order. The script opens in the Transaction Recovery panel on the right.
• Redo (Replay) — Generates a T-SQL script that replays all DML operations in the selected transaction in original order. It uses the same panel.

Transaction Isolation

You can isolate one or more transactions to generate a combined recovery script:

1. Select a transaction and click Isolate Selected. Repeat for additional transactions.
2. The N isolated counter shows how many are queued.
3. Click Generate Undo for Isolated to produce a single combined undo script covering all isolated transactions.
4. Click Clear All to reset the isolation queue.

Point-in-Time Recovery

Point-in-time recovery lives on the Log Entries page. Click Point-in-Time Recovery in the toolbar to open a panel from the right. Stay on the log rows while you pick a table and time.

1. Read the log, then click Point-in-Time Recovery.
2. Select the Table (if a log row or transaction is selected, that table is pre-filled as schema.table, for example dblense_wt.Probe rather than dbo.Probe).
3. Set the target Date and Time.
4. Click Generate PIT Script.
5. Copy or export the script, review it in SSMS, then run it.

The tool finds committed transactions on that table whose commit time is after your target, then emits undo T-SQL for each DML row (same decode path as transaction undo). The script is wrapped in BEGIN TRY / BEGIN CATCH.

Tip: PIT uses the full loaded transaction set (not only the filtered Transactions grid), so narrowing UI filters does not silently omit recovery candidates.

Row-level undo/redo for a single log row stays in the bottom pane on Log Entries. PIT is for restoring a whole table to a moment in time.

Transaction Recovery (Undo / Redo)

On the Transactions page, click Transaction Recovery to open a panel from the right. Select a transaction, then click Undo or Redo. You can also use the Undo / Redo buttons on the entries bar under the grid — they open the same panel.

For DML transactions (INSERT, UPDATE, DELETE), the script includes reverse or replay statements built from decoded row images. Isolation undo (multiple selected transactions) uses the same panel.

Generate Undo and Redo together before you execute either script. After undo runs, the live row is already reversed, so a redo generated later may see the old values as if they were new.

DDL Transactions

When you select a DDL transaction (CREATE TABLE, ALTER TABLE, DROP TABLE, TRUNCATE) and click Undo, the Transaction Recovery panel shows a diagnostic block instead of executable DML — because SQL Server’s transaction log does not store the original DDL text in a decodable form. The diagnostic block includes:

• The DDL operation type (e.g., CREATE TABLE)
• A ready-to-run SQL query to identify which object was affected at that timestamp
• The appropriate manual reversal hint (e.g., DROP TABLE [schema].[tableName] to undo a CREATE)

See DDL in the Log for a full explanation.

Export Buttons

There is no separate Recovery tab. Use Export ▾ on Log Entries and on Transactions, or File → Export:

• Log as CSV — Export the current log entries (Log Entries page).
• Excel — SpreadsheetML workbook of the current log entries.
• HTML Report — Dark-themed HTML report with summary, entries, and transactions (capped at 5,000 rows; you are warned if truncated).
• Transactions CSV — Export the transaction summary (Transactions page).
• Recovery SQL / Export .sql — Save the generated PIT or undo/redo script from the side panel.
• Open in editor — Open that script in SSMS or the default .sql app. The tool never runs it against the database.
• Save / Open Investigation — File menu JSON of source and filters only.

Analysis Tab

The Analysis tab groups three investigative views in one place (sub-tabs):

• Summary — Counts and breakdowns for the loaded window
• Timeline — Chronological DML transactions with ⚠ alert flags
• Row History — Lifecycle of individual rows by table / key

Timeline & Alerts

Under Analysis → Timeline, each DML-bearing transaction appears in time order so you can scan activity quickly. An info icon (🛈) in the header and a blue banner explain the alert rules.

Grid columns

Alert / risky flags

Alerts are heuristics for review — they do not auto-recover or block anything. They help you spot risky patterns fast:

When more than one rule matches, the Alert column lists every reason (for example mass delete and large transaction together).

Timeline respects the same duration / date / table / login filters as Log Entries. Click Apply after changing filters to refresh Timeline with the rest of the UI.

Summary

Under Analysis → Summary, a statistical overview of the loaded log data:

• Total log entries, total transactions, and DML operation counts (Insert / Update / Delete / DDL)
• First and last entry timestamps covering the loaded window
• Total log data size
• Per-table breakdown of operations (how many inserts, updates, deletes per table)
• Per-login breakdown (which logins made how many changes)

Note: Summary statistics are computed from all entries read in the current session, not just the currently filtered view.

Row History

Under Analysis → Row History, track the full change history of individual rows across loaded transactions:

• Rows are grouped by table and primary key value.
• Each row history chain shows every INSERT, UPDATE, and DELETE that touched that specific record, in chronological order.
• Use this to reconstruct the complete lifecycle of a record — from creation to deletion.
• Select a history chain on the left to see the individual change events on the right with timestamps and login names.

Row history chains are built from all entries loaded in the current session.

Monitor Active Log

Polls the live database transaction log at regular intervals and shows new entries as they arrive — like a live tail of the SQL Server log. Monitoring opens in its own dialog from the toolbar button Monitor Active log (it is not a main tab).

How to use it

1. Connect to a database (online log). You can start monitoring after a Read Log, or open the dialog and start from there.
2. Click Monitor Active log on the toolbar (after Browse).
3. Use the same filters as Log Entries: table, login, transaction ID, duration / date range, and Exclude system transactions.
4. Click Start Monitoring. New log entries appear in the grid in real time. Login and time on DML rows come from that transaction’s BEGIN TRAN.
5. Click Close (or the window X) to stop monitoring and dismiss the dialog. Stop Monitoring pauses the poll without closing the window.

Monitor interval

The default poll interval is configurable. A shorter interval gives more real-time visibility but increases SQL Server load. For busy databases, 5–10 seconds is a good starting point.

What Monitor refreshes

Each poll appends new user DML. Ghost cleanup (SQL Server’s background delete of leftover index rows) is hidden so one user DELETE does not appear twice. Allocation-page noise (PFS/IAM) is not treated as a row change.

Clearing the file source returns the tool to online-database mode for monitoring.

Filtering

All filters are applied to the Log Entries, Transactions, and Analysis → Timeline views simultaneously. You do not need to re-read the log after changing filters — the data is re-filtered in memory.

Reset restores all filters to their defaults (Last 1 Hour, all operation types visible, no text search).

The status bar names the filter that hid everything when the grid is empty (search, table, login, transaction, or duration). After an offline .trn / .ldf read, leftover search text from the live session is cleared automatically if it would hide every backup row.

Export Options

Light / Dark buttons sit on the left sidebar (or File → Dark Theme). The whole window, including dialogs, follows the theme.