Documentation / Log Reader / Common Workflows

Common Workflows

Practical recovery and audit scenarios with Log Reader.

Before any recovery script: back up the database (or restore a copy), generate both Undo and Redo while data is still in the after-change state, save the .sql files, and review them in SSMS. Do not run the same undo twice. Full limits: Undo / Redo script limits.

Undo an accidental DELETE / UPDATE

  1. Connect and select the database (FULL recovery recommended so the log has not been truncated).
  2. Narrow filters to the table and approximate time window, then Read Log.
  3. On Log Entries, find the offending operations. Open Data Changes if you need before/after values.
  4. On the row or on the Transactions tab, generate Undo and Redo and save both scripts.
  5. Review the SQL (keys, SET columns, lookup comments). Test on a copy when you can, then run Undo under change control.
  6. For multi-statement accidents, use Transaction Recovery on the Transactions page rather than one row at a time.
Row-level undo and redo scripts generated for a selected UPDATE Before / After values used to confirm the UPDATE before running undo Transaction Recovery panel for a whole transaction instead of a single row

Point-in-time recovery script

  1. On Log Entries, click Point-in-Time Recovery to open the side panel. Set the table as schema.table and the target time.
  2. Generate the PIT script (undo of decoded DML after that time on that table only).
  3. Export the script; execute under change control after backup verification. Schema/DDL is not included.
Point-in-Time Recovery panel generating undo SQL for one table after a chosen timestamp

Audit who changed a row

  1. Use Row History / filters for the table and key.
  2. Walk the timeline of INSERT/UPDATE/DELETE entries. Login and time come from the transaction begin.
  3. Export CSV, Excel, or HTML for the ticket.

Watch new changes live

  1. Connect to the online database and click Monitor Active log on the toolbar.
  2. Set table / login / time filters (same as Log Entries) and start monitoring.
  3. Click Close to stop the poll and dismiss the dialog. Ghost cleanup duplicates are not shown.
Monitor Active log dialog polling the live database

Read a log backup (.trn / .bak)

  1. Clear or ignore leftover Search / table filters from a previous live read (the tool also clears them automatically if they would hide every backup row).
  2. Set Source to Log backup (.trn) or Full backup (.bak) (or leave Online and Browse — Backup Files is first in that dialog).
  3. Click Browse and open the .trn or .bak.
  4. Click Read Log. Duration is fitted to the records in the file so Last 1 Hour does not hide yesterday’s backup.
  5. The status bar should show a non-zero count. If it says Showing 0 after filters, the empty-state text names the remaining filter (search, table, login, txn, or duration).
Log Entries after reading a .trn backup file, with rows visible in the grid

Pause and resume an investigation

  1. After you have the source, database, duration, table/login/txn/LSN filters, and search the way you want, use File → Save Investigation.
  2. Later, File → Open Investigation restores those settings. Connect to the same server if needed.
  3. Click Read Log. Opening the JSON does not run the read for you, so a stale file path cannot surprise-query the instance.