Nov 25, 2016

Transaction Logs in SQL server. Why we need and how can we read transaction log in SQL Server?

Problem: As we know SQL server Master DB store all the information of table, schema, stored procedures, function, triggers etc. But what is about the operational information, if any problem like error or bug happened in our process execution or some intruder want to do nasty on your server like SQL injection. How can we track this type of issue in Our SQL Server?

Solution: Transaction log may help you to track this problem, Transition log may be the evidence for such type of problems.

Basic Operation captured by Transaction: Before explanation about transaction log, we should to know what SQL operations are captured by transaction log.

Transaction log captured all the DML operation like INSERT, UPDATE, DELETE and also some DDL operation like CREATE, TRUNCATE and DROP,

Why to read SQL Server transaction log?

Transaction log contains all the information about the transaction we performed in our database. If we did some operation by mistake like delete or we lost some data and we want to recover lost data then transaction log may help you to resolve this problem. 

Way of reading SQL Server transaction log.

We can’t read directly to transaction log because of security reason. SQL Server provides us some function to decode it. The function are fn_dblog() and fn_dump_dblog(). For the security purpose transaction log stores the information in encrypted (not human readable) format so we could not read it directly.

View SQL Server transaction log using fn_dblog() funation:



The fn_dblog() is an undocumented function of SQL Server, which is allow to view the transaction log records in the active part of the transaction log file for the current database.

Fn_dblog() function takes two parameters, start LSN and end LSN.

Start LSN: Starting log sequence number, or LSN, you can also specify null which means it will return everything from the start of log.

End LSN: Ending log sequence number, or LSN, you can specify null which means you want to return everything to end of the transaction log.

Note: Undocumented means, if you are using this function in SQL Server, which is against of production database instances executed on your own risk. I will explain only fn_dblog() function only in this article.

How to use fn_dblog() function in SQL Server?

If I will explain uses of fn_dblog() on existing database it may create confusion so I am using new database from creation step by step.

1-Step:  Create database ‘Codefari’.


USE[master]
GO

CREATE DATABASE Codefari
GO


2-Step: Create table ‘Blogs’.


USE [Codefari]
GO
CREATE TABLE Blogs
(
            ID INT IDENTITY(1,1) NOT NULL,
            TITLE VARCHAR(MAX)
)


3-Step: In this step we will check how much process has been used by SQL Server to create database and table.




USE [Codefari]
GO
SELECT COUNT(*) FROM fn_dblog(null,null)









You can see 180 steps taken by SQL Server to complete this process.

4-Step: In this step you can see what data available in log.


USE [Codefari]
GO

SELECT
[Current LSN],
[Operation],
[Transaction Name], 
[Context],
[Transaction ID],
[AllocUnitName],
[Page ID],
[SPID],
[Parent Transaction ID],
[Description]
FROM fn_dblog(NULL, NULL)















5-Step: In this step we will perform some DML operation and will track transaction information in Log.


INSERT INTO Codefari.[dbo].[Blogs] VALUES('Transaction log in Codefari')
GO
UPDATE Codefari.[dbo].[Blogs] SET [TITLE]='Transaction log in Codefari.com' WHERE ID=1
GO
DELETE FROM Codefari.[dbo].[Blogs] WHERE ID=1
GO


6-Step: This step will show the transaction which we have performed in 5-step.


USE [Codefari]
GO

SELECT
[Current LSN],
[Transaction ID],
[Operation],
[Transaction Name],
[Context],
[AllocUnitName],
[Page ID],
[Slot ID],
[Begin Time],
[End Time],
[Number of Locks],
[Lock Information]
FROM sys.fn_dblog(NULL,NULL)
WHERE Operation IN
('LOP_INSERT_ROWS','LOP_MODIFY_ROW',
'LOP_DELETE_ROWS','LOP_BEGIN_XACT','LOP_COMMIT_XACT')


















We can see in above steps how fn_dblog() function shows the captured transaction logs and made the transactions in human readable format.

Above experiment and points give consequences as, fn_dblog() can be used when user want to view SQL transaction log. User can easily check the transaction log to see the activities like page splits or objects being drops etc.