# Deleted record in adabas table version 6.3, in windows plataform **URL:** \ **Category:** Forum\ **Tags:** Adabas-Natural, Adabas, Adabas-on-Windows-UNIX, Adabas-on-Linux, Adabas-Utilities-on-Open-Systems\ **Created:** [February 5, 2013, 2:36pm UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201 "2013-02-05T14:36:16Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Alejandro\_Espinosa1](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/alejandro_espinosa1/32/175_2.png) [@Alejandro\_Espinosa1](https://techcommunity.softwareag.com/u/Alejandro_Espinosa1)\ **Post date:** [February 5, 2013, 2:36pm UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/1 "2013-02-05T14:36:16Z")
Hi all. How i can know, who process delete thousands of records in a table of the database version 6.3, There exists any utilities or something like can help me detect this situation. The scenario: The day 01/31/2013 i have 100,000 record, and the day 02/01/2013 only have 93,000 record, and i search for all the programs that make delete and not find anything that tell me what or how it happens. Thanks for any idea or suggestion. ---
**Author:** ![Brian\_Johnson1](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/brian_johnson1/32/163_2.png) [@Brian\_Johnson1](https://techcommunity.softwareag.com/u/Brian_Johnson1)\ **Post date:** [February 5, 2013, 2:44pm UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/2 "2013-02-05T14:44:04Z")
I am a mainframer but I know SAG keeps the same concepts most of the time across platforms. The main thing to ask is to you have protection logging turned on for the db in question, and if so, do you still have the PLOG copies lying around that cover the time period in question? If the answer to both of these is yes, then you just need to do an ADASEL utility to scan the PLOGs for changes to rows on this file (perhaps limiting to deletions). I assume you can get the output of this sent to some ASCII file to browse after. Once you produce this, hopefully the output will be able to show you a lot of deletion events and will provide you info about the user or his session to identify who it was. Hopefully someone with more of a Windows expertise will fill in the gaps where I have doubts. ---
**Author:** ![system](https://global.discourse-cdn.com/techcommunity/original/3X/c/d/cd19967bb605d28a72d77eb83a1cae22f3df2eb8.svg) [@system](https://techcommunity.softwareag.com/u/system)\ **Post date:** [February 5, 2013, 2:59pm UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/3 "2013-02-05T14:59:16Z")
I agree with Brian. A command log might also help but I doubt you have such one switched on. ---
**Author:** ![Alejandro\_Espinosa1](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/alejandro_espinosa1/32/175_2.png) [@Alejandro\_Espinosa1](https://techcommunity.softwareag.com/u/Alejandro_Espinosa1)\ **Post date:** [February 5, 2013, 7:50pm UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/4 "2013-02-05T19:50:45Z")
In windows platforms wheres is adasel or similar??? thank´s for your response ---
**Author:** ![Alejandro\_Espinosa1](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/alejandro_espinosa1/32/175_2.png) [@Alejandro\_Espinosa1](https://techcommunity.softwareag.com/u/Alejandro_Espinosa1)\ **Post date:** [February 5, 2013, 7:54pm UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/5 "2013-02-05T19:54:37Z")
i am trying with ADAPLP, but, how can get the user or session id, that make the operation, i get the day and time, but need the user or session id, thank´s for any idea. ---
**Author:** ![Douglas\_Kelly](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/douglas_kelly/32/102_2.png) [@Douglas\_Kelly](https://techcommunity.softwareag.com/u/Douglas_Kelly)\ **Post date:** [February 6, 2013, 1:29am UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/6 "2013-02-06T01:29:02Z")
[http://techcommunity.softwareag.com/ecosystem/documentation/adabas/ada63os/utils/plp.htm#plp](http://techcommunity.softwareag.com/ecosystem/documentation/adabas/ada63os/utils/plp.htm#plp) You can limit your selection to the specific files in question with the FILES control parameter. [http://techcommunity.softwareag.com/ecosystem/documentation/adabas/ada63os/utils/plp.htm#plpfile](http://techcommunity.softwareag.com/ecosystem/documentation/adabas/ada63os/utils/plp.htm#plpfile) ---
**Author:** ![Ralph\_Zbrog](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/ralph_zbrog/32/78_2.png) [@Ralph\_Zbrog](https://techcommunity.softwareag.com/u/Ralph_Zbrog)\ **Post date:** [February 6, 2013, 2:48am UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/7 "2013-02-06T02:48:09Z")
The protection log will tell you what happened. It’s the command log that will tell you who did what. Not many shops have a CLOG running. Record stores and updates might include the user ID performing the action, via application code or Adabas’ new system-generated fields, but for record deletions it’s unlikely. ---
**Author:** ![system](https://global.discourse-cdn.com/techcommunity/original/3X/c/d/cd19967bb605d28a72d77eb83a1cae22f3df2eb8.svg) [@system](https://techcommunity.softwareag.com/u/system)\ **Post date:** [February 6, 2013, 9:28am UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/8 "2013-02-06T09:28:34Z")
I think Adabas logs the same system information for a delete as for insert and update. But if you can relate this to an end-user might not be that easy. Adabas is only interested in the physical userid (terminal, process, …) and there may not be a logical userid. ---
**Author:** ![Matthias1](https://avatars.discourse-cdn.com/v4/letter/m/9fc348/32.png) [@Matthias1](https://techcommunity.softwareag.com/u/Matthias1)\ **Post date:** [February 6, 2013, 10:19am UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/9 "2013-02-06T10:19:36Z")
> [@Alejandro Espinosa](#): > > i am trying with ADAPLP ADAPLP works. Here’s an example from by ADAPLP-output: ```auto %ADAPLP-I-STARTED, 06-FEB-2013 10:26:39, Version 6.1.10.10 (Solaris 64Bit) [...] Rec 6, lng 12, seq 546205597, type CE, th 1 >>> DELETE FILE 235 ISN 16046262 TSN 759 INTERNAL ID 19368 <<< Rec 7, lng 40, seq 546205598, type ET, th 1, internal id 19368 prio 0, clu 0, ET-TSN 0, TSN 759, user-id R1680 ``` Rec 6 = the delete-command Rec 7 = the END TRANSACTION Internal ID = adabas id of the user-queue entry TSN=sequencial Transaction No per Internal ID user-id = Adabas-ETID ---
**Author:** ![Alejandro\_Espinosa1](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/alejandro_espinosa1/32/175_2.png) [@Alejandro\_Espinosa1](https://techcommunity.softwareag.com/u/Alejandro_Espinosa1)\ **Post date:** [February 6, 2013, 2:55pm UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/10 "2013-02-06T14:55:46Z")
[img]Hello all, Thank´s for your attention, the output of PLP have: ![plp.jpg](https://global.discourse-cdn.com/techcommunity/original/2X/0/010eb455b8523f6b48645fc7e658264291f545d7.jpeg) ---
**Author:** ![Alejandro\_Espinosa1](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/alejandro_espinosa1/32/175_2.png) [@Alejandro\_Espinosa1](https://techcommunity.softwareag.com/u/Alejandro_Espinosa1)\ **Post date:** [February 6, 2013, 2:56pm UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/11 "2013-02-06T14:56:39Z")
for all the records reports the same user-id: TT, that´s wrong?? ---
**Author:** ![Brian\_Johnson1](https://sea1.discourse-cdn.com/techcommunity/user_avatar/techcommunity.softwareag.com/brian_johnson1/32/163_2.png) [@Brian\_Johnson1](https://techcommunity.softwareag.com/u/Brian_Johnson1)\ **Post date:** [February 6, 2013, 3:03pm UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/12 "2013-02-06T15:03:09Z")
That’s not wrong (necessarily). What you show is a series of ET commands by the same user. Odd we aren’t seeing any other commands (updates, deletes, etc.), but it’s not unusual for a single user to run a long process with many sequential transactions. ---
**Author:** ![system](https://global.discourse-cdn.com/techcommunity/original/3X/c/d/cd19967bb605d28a72d77eb83a1cae22f3df2eb8.svg) [@system](https://techcommunity.softwareag.com/u/system)\ **Post date:** [February 7, 2013, 9:52am UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/13 "2013-02-07T09:52:45Z")
Do you only filter ET commands? ---
**Author:** ![system](https://global.discourse-cdn.com/techcommunity/original/3X/c/d/cd19967bb605d28a72d77eb83a1cae22f3df2eb8.svg) [@system](https://techcommunity.softwareag.com/u/system)\ **Post date:** [April 2, 2021, 3:02pm UTC](https://techcommunity.softwareag.com/t/deleted-record-in-adabas-table-version-6-3-in-windows-plataform/102201/14 "2021-04-02T15:02:49Z")