Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 2 subscribers
  • Views 1516 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Export list of data control event from database

AzwanArif

Hi All,

Currently we have a request to export out event list for particular user/computer which able to generate by event viewer before computer deleted from SEC.

Appreciate if anyone can guide or provide sql command/script to export out the data control event base on specific user/machine. Thanks

User Deployment:

SEC and Database server is located on different virtual server.



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to QC

    Hi Christian,

    Yes correct. If possible  I'm plan to extract the data from SQL since the report history still available . Thanks

  • 0 in reply to AzwanArif

    Hello AzwanArif,

    if the computer is still in the database as deleted then it is probably easier to undelete it and then use the Event Viewer.

    First try to find it by its name in the database (assuming instance is SOPHOS and SEC 5.5.1). Execute the command in a cmd window on the database server or use server\instance:
    sqlcmd -E -S .\SOPHOS -d SOPHOS551 -Q "SELECT Id, Name FROM ComputersAndDeletedComputers WHERE Name='computer'"
    If this returns more than one line the computer you are looking for is probably the one with the highest Id.
    sqlcmd -E -S .\SOPHOS -d SOPHOS551 -Q "UPDATE Computersanddeletedcomputers SET Deleted=0 WHERE Id=IdFromAbove"

    Christian

Unfiltered HTML