Locating table truncation source

Question

Hi all,
I have a problem with a database schema that I use, but am not a DBA for. Every night certain tables are truncated from 200,000+ records to just 100 records. At first I wasn't sure if it was a table deletion or a truncation, so i set up a trigger for both events that populate an audit table to identify who, when and what is happening. This is the trigger for the truncate check:
CREATE OR REPLACE TRIGGER IDMS_TMP.capture_trunc
before truncate on schema
WHEN (
ora_dict_obj_name='E_TRACK_WO_SSL_VALID' AND ora_dict_obj_TYPE='TABLE'
DECLARE
IntPKID NUMBER;
Begin
IntPKID := 0;
   SELECT SEQ_ZATSW_PKID.NEXTVAL INTO IntPKID FROM dual;
INSERT INTO Z_AUDIT_TRK_SSL_WO (ZATSW_PK_ID, ZATSW_USER_ID, ZATSW_DATE, ZATSW_ALTERTYPE) Values (  IntPKID, USER, SYSDATE, 'TRUNCATE');
END;This returned the following results:
ZATSW_USER_ID ZATSW_DAT ZATSW_ALTERTYPE
SYS 12-APR-2010 21:35:35 TRUNCATESo i can tell that it is a truncation, occurring at 9:35pm, run by the sys user, but I still need to track down how this being run. So my question is:
Does anyone know how to capture the executing statement causing the truncation, be it a PL/SQL stored proc, scheduled job, manual SQL statement or some other method or identifying what is deleting the data? This would help me to eliminate the cause but at the moment i can only tell who and when, not how or why :(
Not even sure why it then populates with 100 records (as a truncate would remove all?) but finding the calling truncate statement location would probably also answer this question :)
Many thanks
Dan

Answer 1

Hi all,
Thanks for the adivse, unfortunately I do not have access to the DBA_JOBS or any other way or finding out what jobs are running (DBA has restricted access). He tells me that the following jobs are scheduled but should not have this sort of impact:
DAILY_PURGE_SCHEDULE
EMD_MAINTENANCE.EXECUTE_EM_DBMS_JOB_PROCS
Both of these are supposed to be general housekeeping tasks so shouldn't do anything like this, but these are the only scheduled jobs that he can find. The only other possible option is that the truncation is coming from another DB schema across one of two DB_Links we have, but when this first happened I created a copy of one the tables, renamed it, and this is still being hit by the subsequent truncation the next day so it doesn't look like it is table specific (although only certain tables seem to be affected).
As i mentioned in my previous post, what I am really after is a method by which the trigger can find the calling package / procedure of the truncation and tell me what is causing the truncation, however i will look into using the log miner, although my understanding fro the DBA is that there is no logging (it is only a dev DB but not sure why no logging was specified), and not sure if a table being truncated would be captured by the redo log?
Cheers
Dan