[20170309]dg环境下在线日志损坏13.txt

本文涉及的产品
日志服务 SLS,月写入数据量 50GB 1个月
简介: [20170309]dg环境下在线日志损坏13.txt http://blog.itpub.net/267265/viewspace-2134665/ http://blog.

[20170309]dg环境下在线日志损坏13.txt

http://blog.itpub.net/267265/viewspace-2134665/
http://blog.itpub.net/267265/viewspace-2134481/

--//按照如下链接,拷贝备用日志到主库,修改文件头偏移0x230 日志组号.以及hws,eot对应位置,欺骗oracle是正常的日志文件.
http://blog.itpub.net/267265/viewspace-2134816/

--//看了一些文档,在论坛问一下,感觉修改组号以及eot=1就ok了,hws不用修改.到现在还不理解hws表示什么??
--//我在论坛问hws等表示什么?链接
http://www.itpub.net/thread-2084723-1-1.html
eot : End Of Thread: indicates if this is the last log
hws = Hdr Write Seq#
dis : DISabled - true if thread disabled at end of this log
--//再次感谢刘工的解答. eot=1明显表示当前日志,而备用日志这里是0,感觉修改这里才是关键.
--//测试看看这样的情况:

1.环境:

--//首先还原环境,我包括异常关机的冷备份,拷贝回来,删除主库的在线日志以及备用日志.

SYS@book> @ &r/ver
BANNER
--------------------------------------------------------------------------------
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production

SYS@book> @ &r/logfile
GROUP# STATUS TYPE    MEMBER                          IS_ GROUP# THREAD# SEQUENCE#       BYTES BLOCKSIZE MEMBERS ARC STATUS     FIRST_CHANGE# FIRST_TIME          NEXT_CHANGE# NEXT_TIME
------ ------ ------- ------------------------------- --- ------ ------- --------- ----------- --------- ------- --- ---------- ------------- ------------------- ------------ -------------------
     1        ONLINE  /mnt/ramdisk/book/redo01.log    NO       1       1       695    52428800       512       1 NO  CURRENT      13276910949 2017-02-28 14:40:12 2.814750E+14
     2        ONLINE  /mnt/ramdisk/book/redo02.log    NO       2       1       693    52428800       512       1 YES INACTIVE     13276889179 2017-02-27 08:59:01  13276910486 2017-02-28 14:40:06
     3        ONLINE  /mnt/ramdisk/book/redo03.log    NO       3       1       694    52428800       512       1 YES ACTIVE       13276910486 2017-02-28 14:40:06  13276910949 2017-02-28 14:40:12
     4        STANDBY /mnt/ramdisk/book/redostb01.log NO
     5        STANDBY /mnt/ramdisk/book/redostb02.log NO
     6        STANDBY /mnt/ramdisk/book/redostb03.log NO
     7        STANDBY /mnt/ramdisk/book/redostb04.log NO
7 rows selected.

--//一些操作参考,不再重复:
http://blog.itpub.net/267265/viewspace-2134816/

2.拷贝备用日志到主机:
$ scp /mnt/ramdisk/book/redostb01.log oracle@192.168.100.78:/mnt/ramdisk/book/redo01.log
oracle@192.168.100.78's password:
redostb01.log      100%   50MB  25.0MB/s   00:02

--//注意这样因为redo的文件头不一样,oracle不会认为那个文件group#1的.

3.修改备用日志文件.

$ bvi80 -s 512 -b 512 /mnt/ramdisk/book/redo01.log
00000200  01 22 00 00 01 00 00 00 B7 02 00 00 00 80 9C B5 ................
00000210  00 00 00 00 00 04 20 0B 6E 21 B7 4F 42 4F 4F 4B ...... .n!.OBOOK
00000220  00 00 00 00 2D 8D 00 00 00 90 01 00 00 02 00 00 ....-...........
00000230  04 00 02 00 6E D8 B7 4F 00 00 00 00 00 00 00 00 ....n..O........
          ~~
00000240  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000250  00 00 00 00 00 00 00 00 00 00 00 00 54 68 72 65 ............Thre
00000260  61 64 20 30 30 30 31 2C 20 53 65 71 23 20 30 30 ad 0001, Seq# 00
00000270  30 30 30 30 30 36 39 35 2C 20 53 43 4E 20 30 78 00000695, SCN 0x
00000280  30 30 30 33 31 37 35 64 39 35 36 35 2D 30 78 66 0003175d9565-0xf
00000290  66 66 66 66 66 66 66 66 66 66 66 00 FF FF FF FF fffffffffff.....
000002A0  B0 1E 71 35 06 20 0E 00 00 00 00 00 02 00 00 00 ..q5. ..........
000002B0  01 00 00 00 65 95 5D 17 03 00 00 00 4C BB DB 37 ....e.].....L..7
000002C0  FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 02 ................
                                              ~~
000002D0  06 20 0E 00 00 00 00 00 B0 1E 71 35 65 95 5D 17 . ........q5e.].
000002E0  03 00 00 00 4C BB DB 37 00 00 00 00 00 20 82 00 ....L..7..... ..
000002F0  00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 ................
00000300  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000310  00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ................
00000320  00 00 00 00 7A C9 21 31 00 00 00 00 00 00 00 00 ....z.!1........
00000330  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000340  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000350  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000360  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000370  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000380  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000390  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003A0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003B0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003C0  12 E9 26 F7 7B 40 C0 80 DC 71 6E 8A 26 4C 32 9F ..&.{@...qn.&L2.
000003D0  27 F7 6C 1F 74 8A 40 20 48 9C 47 0B 46 31 76 E0 '.l.t.@ H.G.F1v.
000003E0  05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000003F0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000400 }

--//修改0x230处 0x04=>0x01. 将group#=1
--//修改0x2CA处 0x00=>0x01. 将eot=1.
--//9CB5 0400 0100 0000 0100  重新做异或操作

$ xor.sh a.txt
9CB5
0400
0100
0000
0100
xor result: 98B5

--//修改0x14,0x15 9CB5=>98B5
--//做异或参考链接:http://blog.itpub.net/267265/viewspace-2134945/

SYS@book> alter system dump logfile '/mnt/ramdisk/book/redo01.log' validate;
System altered.

DUMP OF REDO FROM FILE '/mnt/ramdisk/book/redo01.log'
Opcodes *.*
RBAs: 0x000000.00000000.0000 thru 0xffffffff.ffffffff.ffff
SCNs: scn: 0x0000.00000000 thru scn: 0xffff.ffffffff
Times: creation thru eternity
VALIDATE ONLY
FILE HEADER:
    Compatibility Vsn = 186647552=0xb200400
    Db ID=1337401710=0x4fb7216e, Db Name='BOOK'
    Activation ID=1337448558=0x4fb7d86e
    Control Seq=36141=0x8d2d, File size=102400=0x19000
    File Number=1, Blksiz=512, File Type=2 LOG
descrip:"Thread 0001, Seq# 0000000695, SCN 0x0003175d9565-0xffffffffffff"
thread: 1 nab: 0xffffffff seq: 0x000002b7 hws: 0x2 eot: 1 dis: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
resetlogs count: 0x35711eb0 scn: 0x0000.000e2006 (925702)
prev resetlogs count: 0x3121c97a scn: 0x0000.00000001 (1)
Low  scn: 0x0003.175d9565 (13276910949) 02/28/2017 14:40:12
Next scn: 0xffff.ffffffff 01/01/1988 00:00:00
Enabled scn: 0x0000.000e2006 (925702) 11/24/2015 09:11:12
Thread closed scn: 0x0003.175d9565 (13276910949) 02/28/2017 14:40:12
Disk cksum: 0xb598 Calc cksum: 0xb598
Terminal recovery stop scn: 0x0000.00000000
Terminal recovery  01/01/1988 00:00:00
Most recent redo scn: 0x0000.00000000
Largest LWN: 0 blocks
End-of-redo stream : No
Maximize performance mode
Miscellaneous flags: 0x822000
Thread internal enable indicator: thr: 0, seq: 0 scn: 0x0000.00000000
Zero blocks: 0
Format ID is 2
redo log key is 12e926f77b40c080dc716e8a264c329f
redo log key flag is 5
Enabled redo threads: 1
END OF REDO DUMP

--//注意看~部分.

4.测试恢复:

SYS@book> recover database  ;
ORA-00279: change 13276910487 generated at 02/28/2017 14:40:06 needed for thread 1
ORA-00289: suggestion : /u01/app/oracle/archivelog/book/1_694_896605872.dbf
ORA-00280: change 13276910487 for thread 1 is in sequence #694
Specify log: {<RET>=suggested | filename | AUTO | CANCEL}
auto
ORA-00283: recovery session canceled due to errors
ORA-00338: log 1 of thread 1 is more recent than control file
ORA-00312: online log 1 thread 1: '/mnt/ramdisk/book/redo01.log'
ORA-01112: media recovery not started


SYS@book> recover database  until cancel;
ORA-00279: change 13276910949 generated at 02/28/2017 14:40:12 needed for thread 1
ORA-00289: suggestion : /u01/app/oracle/archivelog/book/1_695_896605872.dbf
ORA-00280: change 13276910949 for thread 1 is in sequence #695
Specify log: {<RET>=suggested | filename | AUTO | CANCEL}
/mnt/ramdisk/book/redo01.log
Log applied.
Media recovery complete.

--//最终确定仅仅修改日志组号以及eot标识为1.

SYS@book> SELECT file#, CHECKPOINT_CHANGE#, CHECKPOINT_TIME,CREATION_CHANGE#  , RESETLOGS_CHANGE#,status, CHECKPOINT_COUNT,fuzzy,name,tablespace_name  FROM v$datafile_header where file#=1;
FILE# CHECKPOINT_CHANGE# CHECKPOINT_TIME     CREATION_CHANGE# RESETLOGS_CHANGE# STATUS     CHECKPOINT_COUNT FUZ NAME                           TABLESPACE_NAME
----- ------------------ ------------------- ---------------- ----------------- ---------- ---------------- --- ------------------------------ ---------------
    1        13276911100 2017-02-28 14:42:35                7            925702 ONLINE                  839 NO  /mnt/ramdisk/book/system01.dbf SYSTEM

--//scn = 13276911100.

--//剩下的重复链接http://blog.itpub.net/267265/viewspace-2134816/操作.
--//确认这个文件记录的是seq#=694的日志文件.
$ scp /mnt/ramdisk/book/redostb02.log oracle@192.168.100.78:/mnt/ramdisk/book/redo03.log
oracle@192.168.100.78's password:
redostb02.log       100%   50MB  50.0MB/s   00:01

$ bvi80 -b 512 -s 512 /mnt/ramdisk/book/redo03.log
--//仅仅需要修改0x230处 0x0500 => 0x0300,重新计算检查和.
2B19
0500
0300
----
2D19

--//这个过程略.
SYS@book> alter database clear  logfile group 2 ;
Database altered.

alter database clear  logfile group 4 ;
alter database clear  logfile group 5 ;
alter database clear  logfile group 6 ;
alter database clear  logfile group 7 ;

5.打开看看:

SYS@book> alter database open ;
alter database open
*
ERROR at line 1:
ORA-01589: must use RESETLOGS or NORESETLOGS option for database open

SYS@book> alter database open noresetlogs;
Database altered.
--//还第一次这样打这个命令使用noresetlogs打开.
--//ok,可以确定日志组号以及eot标识就ok了.

SYS@bookdg> @ &r/dg/dg
PROCESS       PID STATUS       CLIENT_P GROUP# THREAD#  SEQUENCE#     BLOCK#     BLOCKS DELAY_MINS
--------- ------- ------------ -------- ------ ------- ---------- ---------- ---------- ----------
RFS         25707 IDLE         UNKNOWN  N/A          0          0          0          0          0
RFS         25709 IDLE         LGWR     3            1        697         19          1          0
ARCH        25658 CLOSING      ARCH     4            1        695          1        154          0
MRP0        25701 APPLYING_LOG N/A      N/A          1        697         19     102400          0
--//日志传输与应用没有问题.

相关实践学习
日志服务之使用Nginx模式采集日志
本文介绍如何通过日志服务控制台创建Nginx模式的Logtail配置快速采集Nginx日志并进行多维度分析。
目录
相关文章
|
4月前
|
监控 安全 Shell
防止员工泄密的措施:在Linux环境下使用Bash脚本实现日志监控
在Linux环境下,为防止员工泄密,本文提出使用Bash脚本进行日志监控。脚本会定期检查系统日志文件,搜索敏感关键词(如&quot;password&quot;、&quot;confidential&quot;、&quot;secret&quot;),并将匹配项记录到临时日志文件。当检测到可疑活动时,脚本通过curl自动将数据POST到公司内部网站进行分析处理,增强信息安全防护。
163 0
|
4月前
|
Java 开发工具 Windows
Windows环境下面启动jar包,输出的日志出现乱码的解决办法
Windows环境下面启动jar包,输出的日志出现乱码的解决办法
|
4月前
|
存储 数据采集 Kubernetes
一文详解K8s环境下Job类日志采集方案
本文介绍了K8s中Job和Cronjob控制器用于非常驻容器编排的场景,以及Job容器的特点:增删频率高、生命周期短和突发并发大。文章重点讨论了Job日志采集的关键考虑点,包括容器发现速度、开始采集延时和弹性支持,并对比了5种采集方案:DaemonSet采集、Sidecar采集、ECI采集、同容器采集和独立存储采集。对于短生命周期Job,建议使用Sidecar或ECI采集,通过调整参数确保数据完整性。对于突发大量Job,需要关注服务端资源限制和采集容器的资源调整。文章总结了不同场景下的推荐采集方案,并指出iLogtail和SLS未来可能的优化方向。
|
21天前
|
JavaScript Serverless Linux
函数计算产品使用问题之遇到Node.js环境下的请求日志没有正常输出时,该如何排查
函数计算产品作为一种事件驱动的全托管计算服务,让用户能够专注于业务逻辑的编写,而无需关心底层服务器的管理与运维。你可以有效地利用函数计算产品来支撑各类应用场景,从简单的数据处理到复杂的业务逻辑,实现快速、高效、低成本的云上部署与运维。以下是一些关于使用函数计算产品的合集和要点,帮助你更好地理解和应用这一服务。
|
3月前
|
运维 安全 Java
SpringBoot运维篇(打包,多环境,日志)
SpringBoot运维篇(打包,多环境,日志)
|
4月前
|
运维 Java Devops
云效产品使用报错问题之自定义环境构建没有日志,也没有报错,如何解决
本合集将整理呈现用户在使用过程中遇到的报错及其对应的解决办法,包括但不限于账户权限设置错误、项目配置不正确、代码提交冲突、构建任务执行失败、测试环境异常、需求流转阻塞等问题。阿里云云效是一站式企业级研发协同和DevOps平台,为企业提供从需求规划、开发、测试、发布到运维、运营的全流程端到端服务和工具支撑,致力于提升企业的研发效能和创新能力。
云效产品使用报错问题之自定义环境构建没有日志,也没有报错,如何解决
|
4月前
|
存储 JSON 数据管理
【云备份|| 日志 day1】项目认识 && 环境准备
【云备份|| 日志 day1】项目认识 && 环境准备
|
25天前
|
Kubernetes Ubuntu Windows
【Azure K8S | AKS】分享从AKS集群的Node中查看日志的方法(/var/log)
【Azure K8S | AKS】分享从AKS集群的Node中查看日志的方法(/var/log)
|
7天前
|
Java
日志框架log4j打印异常堆栈信息携带traceId,方便接口异常排查
日常项目运行日志,异常栈打印是不带traceId,导致排查问题查找异常栈很麻烦。
|
17天前
|
存储 监控 数据可视化
SLS 虽然不是直接使用 OSS 作为底层存储,但它凭借自身独特的存储架构和功能,为用户提供了一种专业、高效的日志服务解决方案。
【9月更文挑战第2天】SLS 虽然不是直接使用 OSS 作为底层存储,但它凭借自身独特的存储架构和功能,为用户提供了一种专业、高效的日志服务解决方案。
49 9