Embodiments of the present invention disclose a method, computer program product, and system for reconstructing a sequence of communications that occurred during a period of database activity monitor unavailability. A database activity monitor receives a first sequence of queries. The database activity monitor determines whether the database activity monitor became unavailable, and, in response to determining that the database activity monitor is unavailable, restarts the database activity monitor. The database activity monitor receives a second sequence of queries, and approximates a third sequence of queries, wherein the third sequence of queries occurred subsequent to the first sequence of queries and prior to the second sequence of queries. The database activity monitor validates the third sequence of queries with reference to a set of security policies.