Onlog - logical logs

Version 12.10.FC9W1 AIX 7 We had a session yesterday, we only caught it after the fact ... that did a lot of inserts and deletes - Checkpoint Completed: duration was 3216 seconds. We normally have 10 second checkpoints, maybe. So I started just looking into that logical log, and identified XID 8250, that did a big delete. My problem is, how to find the user that did it, and maybe, if it is possible, what the user was doing (session/table/application/source). Sorry. Hope this makes sense the way I ask it. addr len type xid id link 46837ac 72 DELITEM 8250 0 46835f8 1e03b75 1e03b75 2047c08 68827 1 10 46837f4 436 HDELETE 8250 0 46837ac 1e03b75 2047c09 371 46839a8 72 DELITEM 8250 0 46837f4 1e03b75 1e03b75 2047c09 68827 1 10 46839f0 436 HDELETE 8250 0 46839a8 1e03b75 2047c0a 371 4683ba4 72 DELITEM 8250 0 46839f0 1e03b75 1e03b75 2047c0a 68827 1 10 4683bec 436 HDELETE 8250 0 4683ba4 1e03b75 2047d01 371 4683da0 72 DELITEM 8250 0 4683bec 1e03b75 1e03b75 2047d01 68827 1 10 4683de8 120 HDELETE 8250 0 4683da0 1e0002e 4acd25 56 4683e60 116 DELITEM 8250 0 4683de8 1e0002e 1e0002e 4acd25 5213 1 55 4683ed4 64 DELITEM 8250 0 4683e60 1e0002e 1e0002e 4acd25 21920 2 4

look for the BEGIN in the log output and the user should be at the end at that line. 1018 56 BEGIN 28 9055 0 04/11/2019 01:00:28 1547 info rmix Mark

Hello. I would use -x with tid (8250). onlog -x 8250 |grep BEGIN should do the trick. But if your transaction has begun on another (previous than current) log, you must use -n parameter, and search for earlier ones (using logid numbers). Be careful because onlog tends to be a long running process that can cause blocking when ran against current log! HTH Best regards Alexandre Marini