who did it?

[wwalice]

Hello, all:

One of our schemas was deleted by somebody. We have a public perl script to clear a schema. Somebody typed it by mistake.

Now the problem is how could i find the user who deleted this schema? We did not set up auditting.

Thanks in advance.

[aracnid]

If you are lucky, try the view V_$SQLTEXT...but there the commands resides for a while. (oracle deletes records by itself by internal intervals)

[wwalice]

I did not get it.

Anyway, thanks very much.

[Kishore]

V$SQLTEXT refers to the present contents of SGA.

When it needs to fetch new set of Statements and it flushes the existing one and puts the new. So, if you can observe that SGA before it over writes then you will get it.

Another way may be, do you have AUDITING enabled. That should help you to get detailes who deleted.

[dsuva]

querying v$sqltext you can see the query/dml string but there is no way you can find out which user had issued the command

[aracnid]

for dsuva:
from v$sqltext you get the ADDRESS, than join from v$session by SADDR, you can get the username.

[JChiappa]

Maybe the poster can dig in the redo log files ? Surelly the transaction IS registered in the redo log files, and AFAIK at least the terminal/machine involved and the time will be there, giving a clue for the culprit.
Is it right ?

[]s
Chiappa