mysql数据库被黑恢复—应用层面delete删除

发表于 2024 年 1 月 12 日 由 惜分飞

客户的mysql被人从应用层面攻击,并且删除了一些数据,导致业务无法正常使用,通过底层分析binlog确认类似恢复操作
20240112131751

确认这类的业务破坏是通过delete操作实现的,客户那边不太幸,客户找了多人进行恢复,现场严重破坏,老库被删除,并且还原了历史的备份文件(非故障第一现场),通过底层扫描恢复出来ibd和page文件,然后解析对应的文件,运气不错,恢复出来客户需要的数据
20240112131907
发表在 MySQL恢复 | 标签为 , | 评论关闭

ORA-00600: internal error code, arguments: [4194], [], [], [], [], [], [], []

发表于 2024 年 1 月 12 日 由 惜分飞

再来一例客户由于断电强制拉库之后,报ORA-600 4194错误的case

Wed Jan 10 22:21:01 2024
ARC3 started with pid=39, OS id=4672 
ARC1: Archival started
ARC2: Archival started
ARC2: Becoming the 'no FAL' ARCH
ARC2: Becoming the 'no SRL' ARCH
ARC1: Becoming the heartbeat ARCH
SMON: enabling cache recovery
Archived Log entry 4517 added for thread 1 sequence 23 ID 0xad378582 dest 1:
[4796] Successfully onlined Undo Tablespace 8.
Undo initialization finished serial:0 start:3480640 end:3480843 diff:203 (2 seconds)
Verifying file header compatibility for 11g tablespace encryption..
Verifying 11g file header compatibility for tablespace encryption completed
SMON: enabling tx recovery
Database Characterset is ZHS16GBK
No Resource Manager plan active
Errors in file E:\APP\ADMINISTRATOR\diag\rdbms\xifenfei\xifenfei\trace\xifenfei_smon_4508.trc 
ORA-00600: internal error code, arguments: [4194], [], [], [], [], [], [], [], [], [], [], []
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
replication_dependency_tracking turned off (no async multimaster replication found)
Wed Jan 10 22:21:03 2024
Block recovery from logseq 24, block 63 to scn 42269588
Recovery of Online Redo Log: Thread 1 Group 3 Seq 24 Reading mem 0
  Mem# 0: E:\ORADATA\xifenfei\REDO03.LOG
Block recovery completed at rba 24.64.16, scn 0.42269589
Block recovery from logseq 24, block 63 to scn 42269587
Recovery of Online Redo Log: Thread 1 Group 3 Seq 24 Reading mem 0
  Mem# 0: E:\ORADATA\xifenfei\REDO03.LOG
Block recovery completed at rba 24.63.16, scn 0.42269588
Errors in file E:\APP\ADMINISTRATOR\diag\rdbms\xifenfei\xifenfei\trace\xifenfei_smon_4508.trc:
ORA-01595: error freeing extent (2) of rollback segment (2))
ORA-00600: internal error code, arguments: [4194], [], [], [], [], [], [], [], [], [], [], []
Starting background process QMNC
Wed Jan 10 22:21:03 2024
QMNC started with pid=40, OS id=6576 
ARC3: Archival started
ARC0: STARTING ARCH PROCESSES COMPLETE
Wed Jan 10 22:21:04 2024
Errors in file E:\APP\ADMINISTRATOR\diag\rdbms\xifenfei\xifenfei\trace\xifenfei_mmon_6584.trc
ORA-00600: internal error code, arguments: [4194], [], [], [], [], [], [], [], [], [], [], []
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Starting background process SMCO
Wed Jan 10 22:21:04 2024
SMCO started with pid=41, OS id=6292 
Exception [type: ACCESS_VIOLATION, UNABLE_TO_READ] [ADDR:0x675E484A] [PC:0xCBBC18, kgegpa()+38]
Wed Jan 10 22:21:06 2024
Errors in file E:\app\Administrator\diag\rdbms\xifenfei\xifenfei\cdump\xifenfeicore.log
ORA-07445: caught exception [ACCESS_VIOLATION] at [kgegpa()+38] [0x0000000000CBBC18]
Wed Jan 10 22:21:08 2024
PMON (ospid: 3212): terminating the instance due to error 397

这个比较简单屏蔽undo,启动库,然后重建undo,导出数据导入新库完成恢复

发表在 Oracle备份恢复 | 标签为 | 评论关闭

记录一次ORA-01200完美恢复

发表于 2024 年 1 月 12 日 由 惜分飞

客户虚拟化平台断电，导致oracle其数据库启动ORA-01200错误

SQL> alter database open;
alter database open
*
ERROR at line 1:
ORA-01122: database file 1 failed verification check
ORA-01110: data file 1: '/oradata/orcl/system01.dbf'
ORA-01200: actual file size of 1122560 is smaller than correct size of 1131520 blocks

对应的alert日志如下

Thu Jan 11 11:36:48 2024
ALTER DATABASE   MOUNT
Successful mount of redo thread 1, with mount id 1685778896
Database mounted in Exclusive Mode
Lost write protection disabled
Completed: ALTER DATABASE   MOUNT
Thu Jan 11 11:36:52 2024
ALTER DATABASE OPEN
Read of datafile '/oradata/orcl/system01.dbf' (fno 1) header failed with ORA-01200
Rereading datafile 1 header failed with ORA-01200
Errors in file /u01/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_ora_10847.trc:
ORA-01122: database file 1 failed verification check
ORA-01110: data file 1: '/oradata/orcl/system01.dbf'
ORA-01200: actual file size of 1122560 is smaller than correct size of 1131520 blocks
ORA-1122 signalled during: ALTER DATABASE OPEN...
Thu Jan 11 11:36:53 2024
Checker run found 1 new persistent data failures
Thu Jan 11 11:41:55 2024
alter database open
Read of datafile '/oradata/orcl/system01.dbf' (fno 1) header failed with ORA-01200
Rereading datafile 1 header failed with ORA-01200
Errors in file /u01/app/oracle/diag/rdbms/orcl/orcl/trace/orcl_ora_12550.trc:
ORA-01122: database file 1 failed verification check
ORA-01110: data file 1: '/oradata/orcl/system01.dbf'
ORA-01200: actual file size of 1122560 is smaller than correct size of 1131520 blocks
ORA-1122 signalled during: alter database open...

报错比较明显system01.dbf文件本来大小应该为1131521个block,但是实际上只有1122561个block,因此无法正常启动,通过修改数据文件欺骗数据库
20240112123849

然后对异常的system文件进行处理,把人工构造的部分除掉

SQL> alter database datafile 1 resize 8770M;

Database altered.

rman检测system文件正常
20240112124307

数据库恢复完成,数据完美恢复(0丢失,不用逻辑迁移),该库可以继续使用,以前有过类似case:
bbed处理ORA-01200故障
ORA-01122 ORA-01200故障处理
ORA-1200/ORA-1207数据库恢复

发表在 Oracle备份恢复 | 标签为 | 评论关闭