Want to get executed query users log in SQL-server Yesterday one of my team members has truncated a few tables, but who have truncated those tables is still a mystery.

Can I have user based query log with the timing of execution? Or something where I can enable that functionality in future??

Currently, I am using SQL-Server 2017 on Linux.

Thank you in advance.
Yes, we had a similar issue as well--for payroll data! Try the default trace as shown in this blog (it appears that this is available for Linux as well):

https://social.msdn.microsoft.com/Forums/sqlserver/en-US/80938ab2-28a4-46eb-8b09-84ab9ae22079/how-to-find-the-user-who-performed-a-truncate-statement?forum=transactsql



Linux default trace location:

http://www.dharmendrakeshari.com/main-file-directory-structure-sql-server-linux/