That’s a difficult position to be in when tracking deletions. The *AFTER image of a deletion is… nothing.

The *AFTER images are useful when doing forward recovery. Restore a file to some past backup point, then apply the *AFTER images from that date/time up to current time.

The *BEFORE images are useful in backwards recovery. Journaled changes can be applied going back in time. They can also be useful in forensic review such as what you ran into.

Naturally, tracking *BOTH images increases space requirements. Receiver management becomes more intensive.

Tom

The info was helpful. I had Journal Image for *AFTER and the deletion entry in journal was not having record data. So I couldn’t identify the entries for those deletions. Again I saw some entries for deletions and I checked those RRNs from Journal with previous update entries in the journal and I got info that who and how the records are deleted.

Thanks, SIM

More likely some other event is causing an appearance of deletion.

For example, you might have a record that has a primary key of ‘ABC’. The next day you find that ‘ABC’ is not in the file and that there are no deletion events in the journal. A potential explanation is that some update process was intended to update a record with key ‘XYZ’ but it retrieved ‘ABC’ and wrote over the top of it. The ‘ABC’ record wasn’t deleted — new data was simply written over it and the ‘ABC’ data was replaced.

There are many possible explanations like that. Essentially all of them will go back to some hidden logic error in an application or to missing controls in ad hoc database access. (Someone with full SQL access can accidentally or purposely change records in confusing ways.

Journaling is the best tool to track nearly all of those issues down. Ensure that the journal records events with IMAGES(*BOTH). Look for any activity at all against the records that disappear, not just ‘delete’ entries.

When you review entries, also be sure to look for any ‘start journaling’ and ‘end journaling’ events. If anything happens when journaling isn’t active, it won’t be recorded. And be sure that all receivers are available for any days in question.

Tom