(1) might be technically possible, but unlikely. More likely it was done through cq, which would not log anything special: just a POST to eval.xqy. Access logs don't usually include POST bodies, so you may not get anything conclusive there.
However the ErrorLog may tell you exactly when the forests were cleared, and you might be able to tie that to one or more requests in the access logs. The filesystem timestamps on the new forest label and journal files might help too. Looking past that it sounds like a trust problem with the admin login. You may need to change the password and create some less-privileged logins for less-trusted users. — Mike > On Feb 11, 2015, at 23:07, judie pearline <[email protected]> wrote: > > Hi All, > > In one of our database all the documents have been deleted[the configuration > remains intact], we are analyzing to find out the root cause. we found that > the documents have been deleted around 8:45 but when we check the access logs > [POST /clear-database-go.xqy ]for 8001 there were no logs registered for the > period of 2 hours from 8:40. > > By checking the CQ access logs we are not able to infer anying. Because as > per my understanding the clearing of DB can happen via admin console > [database or forest clear] or via CQ queries. > > Please clarify & guide, > > 1. Is it possible to delete the access log for some specific time period or > wat is the reason for logs not getting registered. > 2. How to analyze the CQ logs with query id. > 2. Am i proceeding in the right direction, else Can you guide us to look at > the proper place to find the necessary logs. > > Thanks in Advance. > > Regards, > Judy > _______________________________________________ > General mailing list > [email protected] > http://developer.marklogic.com/mailman/listinfo/general
_______________________________________________ General mailing list [email protected] http://developer.marklogic.com/mailman/listinfo/general
