Disappearing data (happens rarely)

Hello all. I know most of you won't believe this problem, but I've seen it
with my own eyes:
For our year-end processes we establish four tables in our SQL database and
populate them. Two of the tables have millions of records, the other two onl
y
have a handful of items.
One day, everything's fine -- then, without warning, data from the smaller
two tables is completely wiped out and every record in the larger tables has
been flagged as processed. I've asked everyone in the company -- nobody has
touched these tables.
The tables in which records are flagged: tbl_Naughty, tbl_Nice
The tables in which data disappears: tbl_Cookies, tbl_Milk
The Network Admins just informed me that their audits show all four tables
were accessed by user CKRINGLE, which does not exist on our domain. I have n
o
idea what that means.
Can anyone shed any light?
Thanks,
Darren
Message posted via webservertalk.com
http://www.webservertalk.com/Uwe/Forum...amming/200512/1What do you mean when you say that the records have been flagged as
processed? Do you mean that, for example, a column in the table called
[processed] has been updated from 0 to 1. This sounds like an application
bug or user error. Also, what software or method do the Network Admins use
to audit the database server?
"Darren Mart via webservertalk.com" <u12409@.uwe> wrote in message
news:5889621722e37@.uwe...
> Hello all. I know most of you won't believe this problem, but I've seen it
> with my own eyes:
> For our year-end processes we establish four tables in our SQL database
> and
> populate them. Two of the tables have millions of records, the other two
> only
> have a handful of items.
> One day, everything's fine -- then, without warning, data from the smaller
> two tables is completely wiped out and every record in the larger tables
> has
> been flagged as processed. I've asked everyone in the company -- nobody
> has
> touched these tables.
> The tables in which records are flagged: tbl_Naughty, tbl_Nice
> The tables in which data disappears: tbl_Cookies, tbl_Milk
> The Network Admins just informed me that their audits show all four tables
> were accessed by user CKRINGLE, which does not exist on our domain. I have
> no
> idea what that means.
> Can anyone shed any light?
> Thanks,
> Darren
> --
> Message posted via webservertalk.com
> http://www.webservertalk.com/Uwe/Forum...amming/200512/1|||Darren,
Customer Support Services in Canada has a lot of experience with
this kind of problem, so you might give them a call. But here are a
couple of suggestions:
Try changing the password for the SAnta account, and if that
doesn't work, try renaming the tables tbl_Cookies and tbl_Milk to
tbl_Coal and tbl_Sticks.
None of this may work, but it might be worth a try.
Oh, a couple other thoughts. Do you have a wide open port in
your firewall that someone might be coming down through? And
if the problem only occurs after the Halloween holiday, take a look here:
http://www.google.com/microsoft?q=%...n+protection%22
Steve Kass
Drew University
Darren Mart via webservertalk.com wrote:

>Hello all. I know most of you won't believe this problem, but I've seen it
>with my own eyes:
>For our year-end processes we establish four tables in our SQL database and
>populate them. Two of the tables have millions of records, the other two on
ly
>have a handful of items.
>One day, everything's fine -- then, without warning, data from the smaller
>two tables is completely wiped out and every record in the larger tables ha
s
>been flagged as processed. I've asked everyone in the company -- nobody has
>touched these tables.
>The tables in which records are flagged: tbl_Naughty, tbl_Nice
>The tables in which data disappears: tbl_Cookies, tbl_Milk
>The Network Admins just informed me that their audits show all four tables
>were accessed by user CKRINGLE, which does not exist on our domain. I have
no
>idea what that means.
>Can anyone shed any light?
>Thanks,
>Darren
>
>|||Someone must have found a ctp* backdoor...
*chimney tunneling protocol
Darren Mart via webservertalk.com wrote:
> Hello all. I know most of you won't believe this problem, but I've seen it
> with my own eyes:
> For our year-end processes we establish four tables in our SQL database an
d
> populate them. Two of the tables have millions of records, the other two o
nly
> have a handful of items.
> One day, everything's fine -- then, without warning, data from the smaller
> two tables is completely wiped out and every record in the larger tables h
as
> been flagged as processed. I've asked everyone in the company -- nobody ha
s
> touched these tables.
> The tables in which records are flagged: tbl_Naughty, tbl_Nice
> The tables in which data disappears: tbl_Cookies, tbl_Milk
> The Network Admins just informed me that their audits show all four tables
> were accessed by user CKRINGLE, which does not exist on our domain. I have
no
> idea what that means.
> Can anyone shed any light?
> Thanks,
> Darren
>|||"JT" <someone@.microsoft.com> wrote in message
news:%23LYef1B$FHA.2392@.TK2MSFTNGP09.phx.gbl...
> What do you mean when you say that the records have been flagged as
> processed? Do you mean that, for example, a column in the table called
> [processed] has been updated from 0 to 1. This sounds like an application
> bug or user error. Also, what software or method do the Network Admins use
> to audit the database server?
JT, read the post again... slowly. :-)
tbl_Naughty, tbl_Nice, tbl_Cookies, tbl_Milk, CKRINGLE,|||Perhaps it's a joke or perhaps he just wants to keep his line of business
confidential and was in the Christmas spirit when he made up the names.
:)
"Raymond D'Anjou" <rdanjou@.canatradeNOSPAM.com> wrote in message
news:%23EK163B$FHA.504@.TK2MSFTNGP09.phx.gbl...
> "JT" <someone@.microsoft.com> wrote in message
> news:%23LYef1B$FHA.2392@.TK2MSFTNGP09.phx.gbl...
> JT, read the post again... slowly. :-)
> tbl_Naughty, tbl_Nice, tbl_Cookies, tbl_Milk, CKRINGLE,
>|||Admit it JT, "You just got punk'd".
http://en.wikipedia.org/wiki/Punkd
"JT" <someone@.microsoft.com> wrote in message
news:OKt4N$B$FHA.1032@.TK2MSFTNGP09.phx.gbl...
> Perhaps it's a joke or perhaps he just wants to keep his line of business
> confidential and was in the Christmas spirit when he made up the names. :)
>
> "Raymond D'Anjou" <rdanjou@.canatradeNOSPAM.com> wrote in message
> news:%23EK163B$FHA.504@.TK2MSFTNGP09.phx.gbl...
>|||Steve Kass wrote:
>Darren,
>Try changing the password for the SAnta account, and if that
>doesn't work, try renaming the tables tbl_Cookies and tbl_Milk to
>tbl_Coal and tbl_Sticks.
>
Steve,
Thanks for the tips! As it turns out, the whole thing was just a result of
the Order By Clause.
(badump bump!)
- D
Message posted via webservertalk.com
http://www.webservertalk.com/Uwe/Forum...amming/200512/1|||"Darren Mart via webservertalk.com" <u12409@.uwe> wrote in message
news:588a12cd74f8b@.uwe...
> Steve Kass wrote:
> Steve,
> Thanks for the tips! As it turns out, the whole thing was just a result
> of
> the Order By Clause.
> (badump bump!)
> - D
Exactly what we needed in this newsgroup... another comedian.
Watch out ML, he's going after your job. :-)|||Sir, you are incorrigible!
"Darren Mart via webservertalk.com" <u12409@.uwe> wrote in message
news:588a12cd74f8b@.uwe...
> Steve Kass wrote:
> Steve,
> Thanks for the tips! As it turns out, the whole thing was just a result
> of
> the Order By Clause.
> (badump bump!)
> - D
> --
> Message posted via webservertalk.com
> http://www.webservertalk.com/Uwe/Forum...amming/200512/1