You: What is the oldest registered event that happened today on the production server?
Claude: The earliest event today was an INSERT into production.heartbeat at 2026-03-20 00:00:01 UTC, a routine heartbeat write from the replication monitor.
You: Generate SQL to recover the deleted order 1042.
Claude: Here's the recovery SQL (dry-run). Review carefully before executing:
SET autocommit = 0;BEGIN;INSERT INTO `production`.`orders` (`order_id`, `customer`, `amount`, `status`)VALUES (1042, 'acme-corp', 299.00, 'active');COMMIT;
Always review recovery SQL
Recovery is always dry-run: Claude generates the SQL but never executes it. A DBA must review and run the SQL manually.
Who-changed attribution is a dbtrail EE capability
Questions like "who was the first person to modify the pricing table since Monday?" need forensic attribution: mapping each change to a MySQL user, host, and client program. The open-source index records each change's raw connection_id; full attribution is part of dbtrail EE.
Be specific about the server. If you have multiple servers, mention which one: "on the production-main server"
Use time ranges: "in the last hour", "since March 1st", "between 2pm and 3pm yesterday"
Filter by event type: "show me only DELETEs", "what was updated"
Reference tables explicitly: "in the orders table in the mydb schema"
Ask for the first or oldest event: "what was the first INSERT today?", "show me the oldest delete since the deploy". Claude retrieves the oldest matching events first without scanning through all results