Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a website with MySQL database. Someone deleted 1,000 records from a table. Is there any way to find out who have deleted the records and when from the website? And from where the records were deleted: from website or from phpmyadmin?

It will be great if anyone can help me.

share|improve this question
up vote 2 down vote accepted

If have already enabled mysql logging, you can just look at the log file. You can find every executed query and you can know the user and IP address of the client.

The logging can be enabled in the config file /etc/mysql/my.cnf:

general_log_file        = /var/log/mysql/mysql.log

If the log file is empty and the log file line is commented, then you don't have the log enabled. AFAIK, you can NOT find such information in this case (no logging).

share|improve this answer
That does not tell me where in my.cnf this needs to go. Also, the IP address is useless for local connections: both a local web site and phpmyadmin (which is also a web site) use the same local Unix socket. – adaptr Mar 20 '12 at 13:59
This is not stated in the OP question. Even though, it still can be considered a general note :) – Khaled Mar 20 '12 at 14:59
My server is windows 2008 server. Please let me know what setting I have to enable and check to enable logging. And also please let me know if the setting not enable is there any way to find who have done the operation on perticular DB. – Jagat Sheth Mar 21 '12 at 4:54

Unless you had the general query log enabled while this happened, no, that information is lost.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.