Identify the action that is deleting all rows in a table

Question

There is SQL Server 2012 database that is used by three different applications. In that database there is a table that contains ~500k rows and for some mysterious reason this ta

Answer 1

You can use Extended Events to monitor your system. Here a simple screen shot where are.

A simple policy can monitor for delete and truncate statements. When this events are raised details are written into file.

Here a screen with details (you can configure the script to collect more data) collected for delete statement.

Here the script used, modify the output file path

CREATE EVENT SESSION [CheckDelete] ON SERVER 
ADD EVENT sqlserver.sql_statement_completed(SET collect_statement=(1)
    ACTION(sqlserver.client_connection_id,sqlserver.client_hostname)
    WHERE ([sqlserver].[like_i_sql_unicode_string]([statement],N'%delete%') OR [sqlserver].[like_i_sql_unicode_string]([statement],N'%truncate%'))) 
ADD TARGET package0.event_file(SET filename=N'C:\temp\CheckDelete.xel',max_file_size=(50))
WITH (MAX_MEMORY=4096 KB,EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,MAX_DISPATCH_LATENCY=30 SECONDS,MAX_EVENT_SIZE=0 KB,MEMORY_PARTITION_MODE=NONE,TRACK_CAUSALITY=OFF,STARTUP_STATE=OFF)
GO