WHO EXECUTED WHICH QUERY?

WHO EXECUTED WHAT?

SELECT db.[transaction name],
sl.NAME 'LoginName',
dp.NAME LOGINROLE,
[current lsn],
[operation],
[transaction id],
[description],
spid,
[begin time],
[transaction sid],
tex.text Most_Recent_SQL_Executed_in_That_Session
FROM Fn_dblog (NULL, NULL) db
LEFT JOIN sys.syslogins sl
ON db.[transaction sid] = sl.sid
LEFT JOIN sys.database_principals dp
ON db.[transaction sid] = dp.sid
LEFT JOIN sys.dm_exec_connections dec
ON db.spid = dec.session_id
LEFT JOIN sys.dm_exec_sessions des
ON db.spid = des.session_id
CROSS apply sys.Dm_exec_sql_text(dec.most_recent_sql_handle) tex
WHERE db.[transaction name] LIKE '%DROPOBJ%'


Using the above query we can find out who executed which query(INSERT/UPDATE/DELETE/DROP etc.), based on the transaction log entry.
Note: we can only get Last executed query in particular session based on column most_recent_sql_handle of system view sys.dm_exec_connections.

Please do not get confuse if you are getting INSERT query but in log you have searched for UPDATE, this is because you have executed INSERT query after UPDATE query in that session,