Warning: file_get_contents(/data/phpspider/zhask/data//catemap/5/sql/72.json): failed to open stream: No such file or directory in /data/phpspider/zhask/libs/function.php on line 167

Warning: Invalid argument supplied for foreach() in /data/phpspider/zhask/libs/tag.function.php on line 1116

Notice: Undefined index: in /data/phpspider/zhask/libs/function.php on line 180

Warning: array_chunk() expects parameter 1 to be array, null given in /data/phpspider/zhask/libs/function.php on line 181
如何使用SQL审计跟踪查找已销毁的数据行_Sql_Sql Server_Tsql_Audit Trail_Data Loss - Fatal编程技术网

如何使用SQL审计跟踪查找已销毁的数据行

如何使用SQL审计跟踪查找已销毁的数据行,sql,sql-server,tsql,audit-trail,data-loss,Sql,Sql Server,Tsql,Audit Trail,Data Loss,我使用一个审计表来查找哪些内容记录了在上运行的单个破坏性SQL语句,例如“2011-01-01 08:00:00.000”。您可以假设每个MyTable记录在脚本运行的当天只更新了一次。此SQL可能由用户运行,无法检索。每当MyTable发生更改时,新值的审核跟踪就会存储在AuditMyTable中 我的原始表架构: MyTable(AccountId int PK, Amount int) AuditMyTable(AccountId int, Amount int, AuditDate d

我使用一个审计表来查找哪些内容记录了在上运行的单个破坏性SQL语句,例如“2011-01-01 08:00:00.000”。您可以假设每个MyTable记录在脚本运行的当天只更新了一次。此SQL可能由用户运行,无法检索。每当MyTable发生更改时,新值的审核跟踪就会存储在AuditMyTable中

我的原始表架构:

MyTable(AccountId int PK, Amount int)
AuditMyTable(AccountId int, Amount int, AuditDate datetime)
MyTable架构的我的审核跟踪表:

MyTable(AccountId int PK, Amount int)
AuditMyTable(AccountId int, Amount int, AuditDate datetime)
我的问题是,如何从AuditMyTable针对自身编写SQL联接,以便返回以下数据:


AuditMyTable.AccountId,AuditMyTable.Amount为[NullAmount],AuditMyTablePrevious.Amount为[PreviousNotNullAmount]

首先,您必须从您的日期中获取我正在创建的序列,假设它们严格增加:

SELECT AccountId, cur.AuditDate AS cur_AuditDate, MAX(prev.AuditDate) AS prev_AuditDate
FROM AuditMyTable AS cur
LEFT JOIN AuditMyTable AS prev
    ON prev.AccountId = cur.AccountId
    AND prev.AuditDate < cur.AuditDate
GROUP BY AccountId, cur.AuditDate
然后使用它:

WITH Ordering AS (
    SELECT AccountId, cur.AuditDate AS cur_AuditDate, MAX(prev.AuditDate) AS prev_AuditDate
    FROM AuditMyTable AS cur
    LEFT JOIN AuditMyTable AS prev
        ON prev.AccountId = cur.AccountId
        AND prev.AuditDate < cur.AuditDate
    GROUP BY AccountId, cur.AuditDate
)
SELECT cur.AccountId, cur.Amount as [NullAmount], prev.Amount as [PreviousNotNullAmount]
FROM AuditMyTable AS cur
INNER JOIN Ordering
    ON Ordering.AccountId = cur.AccountId
    AND Ordering.cur_AuditDate = cur.Audit_Date
LEFT JOIN AuditMyTable AS prev
    ON prev.AccountId = cur.AccountId
    AND prev.Audit_Date = Ordering.prev_AuditDate

您只对已知时间内的一条特定记录或整个表感兴趣?本质上,您试图发现一个记录PK列表,该列表在SQL运行之前具有一个值,然后在SQL运行时变为null。