[20150505]关于alert.log文件.txt
--alert.log文件记录系统报警信息以及关键记录,对于数据库的诊断很有帮助.
--我记得以前有过一次经历使用vim,不小心编辑了alert文件,导致后续的日志信息无法追加到文件中.
--实际上这个因为编辑保存后,文件inode发生了变化.而出现这样的情况.
1.先来看看10g的情况:
SCOTT@test> @ &r/ver1
PORT_STRING VERSION BANNER
------------------------------ -------------- ----------------------------------------------------------------
x86_64/Linux 2.4.xx 10.2.0.4.0 Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - 64bi
SCOTT@test> @ &r/spid
SID SERIAL# SPID C50
------------ ------------ ------ --------------------------------------------------
157 7 26687 alter system kill session '157,7' immediate;
$ ls -l /proc/26687/fd | grep -i alert
--无显示!
SCOTT@test> alter system archive log current ;
System altered.
$ ls -l /proc/26687/fd | grep -i alert
lr-x------ 1 oracle oinstall 64 2015-05-05 08:13:45 6 -> /u01/app/oracle/admin/test/bdump/alert_test.log
--可以发现在执行alter system archive log current ;后,打开了alert*.log文件.
# lsof | grep -E 'alert_test.log|PID'
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
oracle 26476 oracle 6w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle 26476 oracle 8w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle 26478 oracle 6w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle 26478 oracle 8w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle 26480 oracle 6w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle 26480 oracle 8w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle 26482 oracle 6w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle 26482 oracle 8w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle 26484 oracle 6w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle 26484 oracle 8w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
...
--如果仔细检查这个系统进程PID,可以发现大部分是后台进程.
# ps -ef | grep "ora_dbw0_test" | grep -v grep
oracle 26482 1 0 08:04 ? 00:00:00 ora_dbw0_test
--也就是讲在数据库启动后,alert*.log的文件句柄就打开了.如果不小心编辑,导致文件inode变化,导致无法追加日志.
--注意mv并不会改变文件的inode信息.
--我做一个mv例子:
$ ls -il alert_test.log
37093990 -rw-r----- 1 oracle oinstall 1497201 2015-05-05 08:14:16 alert_test.log
$ mv alert_test.log alert_test.log_xxx
$ ls -il alert_test.log_xxx
37093990 -rw-r----- 1 oracle oinstall 1497201 2015-05-05 08:14:16 alert_test.log_xxx
--可以发现前面的数字37093990是文件的inode号,没有变化.
# lsof | grep -E 'alert_test.log|PID'
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
oracle 26476 oracle 6w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx
oracle 26476 oracle 8w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx
oracle 26478 oracle 6w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx
oracle 26478 oracle 8w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx
oracle 26480 oracle 6w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx
oracle 26480 oracle 8w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx
oracle 26482 oracle 6w REG 8,3 1497201 37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx
---可以发现这些文件系统指向新的文件名.
---在前面的会话执行alter system archive log current ;会出现什么情况呢?
$ ls -l /proc/26687/fd | grep -i alert
lr-x------ 1 oracle oinstall 64 2015-05-05 08:13:45 6 -> /u01/app/oracle/admin/test/bdump/alert_test.log
--有建立新的alert文件并打开新的句柄.
# lsof | grep -E 'alert_test.log$|PID'
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
oracle 26488 oracle 8w REG 8,3 459 37094613 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle 26490 oracle 8w REG 8,3 459 37094613 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle 26687 oracle 6r REG 8,3 459 37094613 /u01/app/oracle/admin/test/bdump/alert_test.log
# ps -ef | grep -E "26488|26490|26687" | grep -v grep
oracle 26488 1 0 08:04 ? 00:00:00 ora_lgwr_test
oracle 26490 1 0 08:04 ? 00:00:00 ora_ckpt_test
oracle 26687 26686 0 08:12 ? 00:00:00 oracletest (DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))
--如果你使用vim编辑看看,可以发现inode发生了变化.
$ ls -li alert_test.log
37095477 -rw-r----- 1 oracle oinstall 804 2015-05-05 08:37:08 alert_test.log
# lsof | grep -E 'alert_test.log|PID' | grep delete
oracle 26488 oracle 8w REG 8,3 805 37095459 /u01/app/oracle/admin/test/bdump/alert_test.log~ (deleted)
oracle 26687 oracle 6r REG 8,3 459 37094613 /u01/app/oracle/admin/test/bdump/alert_test.log~ (deleted)
--总之最好不好选择查看时,不要选择保存,最好选择view模式.
2.再来看看11g的情况:
SYS@test> @ver1
PORT_STRING VERSION BANNER
------------------------------ -------------- --------------------------------------------------------------------------------
x86_64/Linux 2.4.xx 11.2.0.3.0 Oracle Database 11g Enterprise Edition Release 11.2.0.3.0 - 64bit Production
# lsof | grep -i alert
--竟然没有输出.
SCOTT@test> @spid
SID SERIAL# SPID C50
---------- ---------- ------ --------------------------------------------------
580 7 3879 alter system kill session '580,7' immediate;
SCOTT@test> alter system archive log current ;
System altered.
# ls -l /proc/3879/fd | grep alert
--竟然没有输出.
# lsof | grep -i alert
--竟然没有输出.
--换一句讲,在写alert*.log完成后,关闭了句柄.
--这样即使编辑文件等各种操作,基本不会导致日志的丢失.
3.当然11G rac下又是不同的情况:
# lsof | grep -E "alert_|PID"
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 20101 root 60r REG 252,3 212216 10764708 /u01/app/grid/diag/asm/+asm/+ASM2/trace/alert_+ASM2.log
java 20101 root 61r REG 252,3 16654048 12142756 /u01/app/oracle/diag/rdbms/dben/dben2/trace/alert_dben2.log
java 20101 root 63r REG 252,3 409450857 12125590 /u01/app/oracle/diag/rdbms/dbcn/dbcn2/trace/alert_dbcn2.log
# ps -ef | grep 20101
root 20101 1 1 2014 ? 1-12:14:54 /u01/app/11.2.0.4/grid/jdk/jre/bin/java -Xms128m -Xmx512m -classpath
/u01/app/11.2.0.4/grid/tfa/dm01dbadm02/tfa_home/jlib/RATFA.jar:
/u01/app/11.2.0.4/grid/tfa/dm01dbadm02/tfa_home/jlib/je-5.0.84.jar:
/u01/app/11.2.0.4/grid/tfa/dm01dbadm02/tfa_home/jlib/ojdbc6.jar:
/u01/app/11.2.0.4/grid/tfa/dm01dbadm02/tfa_home/jlib/commons-io-2.2.jar oracle.rat.tfa.TFAMain
/u01/app/11.2.0.4/grid/tfa/dm01dbadm02/tfa_home
--这个是tfa的东东,好像以读的方式打开.看来11G已经发生了变化,打开读写完成后,会关闭alert文件的句柄.
