I try to find out the date when a big document deletions occured in a database.
Does the information provided by log.nsf (read/write/transactions) give any clue about such an event?
Subject: Does log.nsf give any clue about mass document deletions?
You could try a simple experiment.Create a dummy db.
Stuff in a ton of document.
Delete them all
Read the log.
We’re developers - live large, experiment! What’s the worst that could happen? 
I’d suggest that if you’re concerned about mass deletions, don’t allow deletions. Provide a method for users to ‘remove’ documents which either sets some flag that removes them from a view and puts them into a ‘hidden doc’ view, or copies them to a ‘deleted doc’ db. If you want to allow deletions, code up a QueryDocumentDelete function to write out who deleted what when.
There was a product that did detect mass deletions. It used the C or C++ API. I think the company was PrimeApple and they’re not doing Notes stuff any more, but you might find someone who can code up a server add-in to do the logging for you.
If you’re concerned about admin/developer type users deleting docs when they shouldn’t be, you could have a problem…not a Notes problem, but a people problem. Whatever you put in place to log/prevent deletions, they can probably disable it, delete the docs and turn back on the lock mechanism. You’re now into forensics to decide if something was modified outside of your change control processes.
HTH
Subject: Does log.nsf give any clue about mass document deletions?
You can look under the usage>by database view in the log to get some information. Another option is the file>database>properties, information tab, ‘user details’ button. It’s a little hard to interpret - create, edit, and delete operations are considered ‘writes’, and there is no way to distinguish between them. But, depending on the information you find, it may give you what you need.
Subject: RE: Does log.nsf give any clue about mass document deletions?
when reading user activity, typically a large # of writes would indicate deletions, unless there is some automated process tied to the ID such as agent processing.
Subject: RE: Does log.nsf give any clue about mass document deletions?
Hi,
Examples of Events that Trigger Read/Write Entries in the User Activity Log for a Database
http://www-1.ibm.com/support/docview.wss?uid=swg21096117
also , look at the link at the bottom of this technote.
JYR
Subject: RE: Does log.nsf give any clue about mass document deletions?
JYR, great source - thank you! This is exactly what I was looking for.
I have to find the cause, why a lot of documents (some 10.000) disapear from a db. Unfortunatly the backup strategy of the Domino installation in question was weak…
Peter