如何使用SQL审计跟踪查找已销毁的数据行
我使用一个审计表来查找哪些内容记录了在上运行的单个破坏性SQL语句,例如“2011-01-01 08:00:00.000”。您可以假设每个MyTable记录在脚本运行的当天只更新了一次。此SQL可能由用户运行,无法检索。每当MyTable发生更改时,新值的审核跟踪就会存储在AuditMyTable中 我的原始表架构:如何使用SQL审计跟踪查找已销毁的数据行,sql,sql-server,tsql,audit-trail,data-loss,Sql,Sql Server,Tsql,Audit Trail,Data Loss,我使用一个审计表来查找哪些内容记录了在上运行的单个破坏性SQL语句,例如“2011-01-01 08:00:00.000”。您可以假设每个MyTable记录在脚本运行的当天只更新了一次。此SQL可能由用户运行,无法检索。每当MyTable发生更改时,新值的审核跟踪就会存储在AuditMyTable中 我的原始表架构: MyTable(AccountId int PK, Amount int) AuditMyTable(AccountId int, Amount int, AuditDate d
MyTable(AccountId int PK, Amount int)
AuditMyTable(AccountId int, Amount int, AuditDate datetime)
MyTable架构的我的审核跟踪表:
MyTable(AccountId int PK, Amount int)
AuditMyTable(AccountId int, Amount int, AuditDate datetime)
我的问题是,如何从AuditMyTable针对自身编写SQL联接,以便返回以下数据:
AuditMyTable.AccountId,AuditMyTable.Amount为[NullAmount],AuditMyTablePrevious.Amount为[PreviousNotNullAmount]首先,您必须从您的日期中获取我正在创建的序列,假设它们严格增加:
SELECT AccountId, cur.AuditDate AS cur_AuditDate, MAX(prev.AuditDate) AS prev_AuditDate
FROM AuditMyTable AS cur
LEFT JOIN AuditMyTable AS prev
ON prev.AccountId = cur.AccountId
AND prev.AuditDate < cur.AuditDate
GROUP BY AccountId, cur.AuditDate
然后使用它:
WITH Ordering AS (
SELECT AccountId, cur.AuditDate AS cur_AuditDate, MAX(prev.AuditDate) AS prev_AuditDate
FROM AuditMyTable AS cur
LEFT JOIN AuditMyTable AS prev
ON prev.AccountId = cur.AccountId
AND prev.AuditDate < cur.AuditDate
GROUP BY AccountId, cur.AuditDate
)
SELECT cur.AccountId, cur.Amount as [NullAmount], prev.Amount as [PreviousNotNullAmount]
FROM AuditMyTable AS cur
INNER JOIN Ordering
ON Ordering.AccountId = cur.AccountId
AND Ordering.cur_AuditDate = cur.Audit_Date
LEFT JOIN AuditMyTable AS prev
ON prev.AccountId = cur.AccountId
AND prev.Audit_Date = Ordering.prev_AuditDate
您只对已知时间内的一条特定记录或整个表感兴趣?本质上,您试图发现一个记录PK列表,该列表在SQL运行之前具有一个值,然后在SQL运行时变为null。