Tuesday, April 3, 2012

Who deleted that Web site?

Sometimes Web sites get deleted. If you want to track down who did it, you can check the IIS logs or check the Content DB.

The query to run on the SQL DB is:

SELECT [Id]
      ,[SiteId]
      ,[EventTime]
      ,[ListId]
      ,[ItemId]
      ,[ItemName]
      ,[ItemFullUrl]
      ,[EventType]
      ,[ModifiedBy]
      ,[TimeLastModified]
      ,[EventData]
      ,[FormattedFragment]
  FROM [].[dbo].[EventLog]
where itemfullurl like '%//%' and EventType = '4'


In the LAST row (by Date), the Column ModifiedBy will be the person that deleted the site. Just double check that the ItemFullUrl has ...'Lists/Site Owner/' ... in it. EventType 4 means 'deleted'.

I do not take responsibility for unfair dismissal. ;-)

It is however likely the person that deleted the site.

No comments:

Post a Comment