Let’s take some random log record from Microsoft SQL Server 2000’s LDF file to be examined :
You can refer to my previous post about determining the exact position of log record of interest.
In this anatomy autopsy session , the focus is to determine the operation, the page id and the slot id of affected database.
Offset 0×0E = 0×06 is the log operation which means (LOP_MODIFY_COLUMNS). You can refer to the complete list of log operation at the end of this post.
Offset 0×0F = 0×01 is the log operation context (LCX_HEAP). The complete list is at the end of this post.
Offset 0×18 through 0×1D is Page Id in the format fileid:page number. In this sample, page id is :
0001:00001F74 which is m_pageId = 1:8052.
Offset 0×1E to 0×1F denotes slot id. In this case, the updated slot is 0×0026 = 38
Below is the list of all log operation codes and its description :
0×00 = LOP_NULL
0×01 = LOP_FORMAT_PAGE
0×02 = LOP_INSERT_ROWS
0×03 = LOP_DELETE_ROWS
0×04 = LOP_MODIFY_ROW
0×05 = LOP_MODIFY_HEADER
0×06 = LOP_MODIFY_COLUMNS
0×07 = LOP_SET_BITS
0×08 = LOP_SET_MASK_BITS
0×09 = LOP_DELTA_SYSIND
0×0A = LOP_SET_FREE_SPACE
0×0B = LOP_DELETE_SPLIT
0×0C = LOP_UNDO_DELETE_SPLIT
0×0D = LOP_EXPUNGE_ROWS
0×10 = LOP_FILE_HDR_MODIFY
0×11 = LOP_CLEAR_GAM_BITS
0×80 = LOP_BEGIN_XACT
0×81 = LOP_COMMIT_XACT
0×82 = LOP_ABORT_XACT
0×83 = LOP_PREP_XACT
0×84 = LOP_MARK_SAVEPOINT
0×85 = LOP_FORGET_XACT
0×88 = LOP_MARK_DDL
0×86 = LOP_CREATE_FILE
0×87 = LOP_DROP_FILE
0×96 = LOP_BEGIN_CKPT
0×98 = LOP_XACT_CKPT
0×99 = LOP_END_CKPT
0×9A = LOP_BUF_WRITE
0×9B = LOP_IDENTITY_TYPE
0xA0 = LOP_BEGIN_RECOVERY
0xA1 = LOP_END_RECOVERY
0xA2 = LOP_NONLOGGED_OP
0xAA = LOP_SORT_BEGIN
0xAC = LOP_SORT_EXTENT
0xAB = LOP_SORT_END
0xAD = LOP_CREATE_INDEX
0xAE = LOP_DROP_INDEX
0xAF = LOP_SORT_MEMORY
0xC8 = LOP_REPL_COMMAND
0xC9 = LOP_BEGIN_UPDATE
0xCA = LOP_END_UPDATE
0xCB = LOP_TEXT_POINTER
0xCC = LOP_TEXT_INFO_BEGIN
0xCD = LOP_TEXT_INFO_END
0xCE = LOP_REPL_NOOP
0xCF = LOP_TEXT_VALUE
0xD3 = LOP_SHRINK_NOOP
List of all log operation context :
0×00 = LCX_NULL
0×01 = LCX_HEAP
0×02 = LCX_CLUSTERED
0×03 = LCX_INDEX_LEAF
0×04 = LCX_INDEX_INTERIOR
0×05 = LCX_TEXT_MIX
0×06 = LCX_TEXT_TREE
0×07 = LCX_DISTRIBUTION
0×08 = LCX_GAM
0×09 = LCX_SGAM
0×0A = LCX_IAM
0×0B = LCX_PFS
0×0C = LCX_IDENTITY_VALUE
0×0D = LCX_OBJECT_ID
0×0E = LCX_NONSYS_SPLIT
0×0F = LCX_CLUSTERED_BULK
0×10 = LCX_INDEX_LEAF_BULK
0×11 = LCX_FILE_HEADER
0×12 = LCX_SCHEMA_VERSION
0×13 = LCX_MARK_AS_GHOST
0×14 = LCX_BOOT_PAGE
0×15 = LCX_SYSCONFIG_PAGE
0×16 = LCX_SORT_MIX
0×17 = LCX_BOOT_PAGE_CKPT
0×18 = LCX_DIFF_MAP
0×19 = LCX_ML_MAP