Deleted record in adabas table version 6.3, in windows plataform

, , , ,
1

Hi all.

How i can know, who process delete thousands of records in a table of the database version 6.3,

There exists any utilities or something like can help me detect this situation.

The scenario:

The day 01/31/2013 i have 100,000 record, and the day 02/01/2013 only have 93,000 record, and i search for all the programs that make delete and not find anything that tell me what or how it happens.

Thanks for any idea or suggestion.

2

I am a mainframer but I know SAG keeps the same concepts most of the time across platforms.

The main thing to ask is to you have protection logging turned on for the db in question, and if so, do you still have the PLOG copies lying around that cover the time period in question?

If the answer to both of these is yes, then you just need to do an ADASEL utility to scan the PLOGs for changes to rows on this file (perhaps limiting to deletions). I assume you can get the output of this sent to some ASCII file to browse after.

Once you produce this, hopefully the output will be able to show you a lot of deletion events and will provide you info about the user or his session to identify who it was.

Hopefully someone with more of a Windows expertise will fill in the gaps where I have doubts.

3

I agree with Brian.

A command log might also help but I doubt you have such one switched on.

4

In windows platforms wheres is adasel or similar???

thank´s for your response

5

i am trying with ADAPLP, but, how can get the user or session id, that make the operation,

i get the day and time, but need the user or session id,

thank´s for any idea.

6

http://techcommunity.softwareag.com/ecosystem/documentation/adabas/ada63os/utils/plp.htm#plp

You can limit your selection to the specific files in question with the FILES control parameter. http://techcommunity.softwareag.com/ecosystem/documentation/adabas/ada63os/utils/plp.htm#plpfile

7

The protection log will tell you what happened. It’s the command log that will tell you who did what. Not many shops have a CLOG running.

Record stores and updates might include the user ID performing the action, via application code or Adabas’ new system-generated fields, but for record deletions it’s unlikely.

8

I think Adabas logs the same system information for a delete as for insert and update. But if you can relate this to an end-user might not be that easy. Adabas is only interested in the physical userid (terminal, process, …) and there may not be a logical userid.

9

ADAPLP works.

Here’s an example from by ADAPLP-output:

%ADAPLP-I-STARTED,      06-FEB-2013 10:26:39, Version 6.1.10.10 (Solaris 64Bit)

[...]

Rec    6, lng    12, seq  546205597, type    CE, th  1


>>> DELETE FILE 235 ISN 16046262 TSN 759 INTERNAL ID 19368 <<<



Rec    7, lng    40, seq  546205598, type    ET, th  1, internal id      19368
       prio 0, clu 0, ET-TSN 0, TSN 759, user-id R1680

Rec 6 = the delete-command
Rec 7 = the END TRANSACTION

Internal ID = adabas id of the user-queue entry
TSN=sequencial Transaction No per Internal ID
user-id = Adabas-ETID

10

[img]Hello all,

Thank´s for your attention,

the output of PLP have:

plp.jpg

11

for all the records reports the same user-id: TT, that´s wrong??

12

That’s not wrong (necessarily). What you show is a series of ET commands by the same user. Odd we aren’t seeing any other commands (updates, deletes, etc.), but it’s not unusual for a single user to run a long process with many sequential transactions.

13

Do you only filter ET commands?