标签云
asm恢复 bbed bootstrap$ dul In Memory kcbzib_kcrsds_1 kccpb_sanity_check_2 MySQL恢复 ORA-00312 ORA-00607 ORA-00704 ORA-00742 ORA-01110 ORA-01555 ORA-01578 ORA-08103 ORA-600 2131 ORA-600 2662 ORA-600 2663 ORA-600 3020 ORA-600 4000 ORA-600 4137 ORA-600 4193 ORA-600 4194 ORA-600 16703 ORA-600 kcbzib_kcrsds_1 ORA-600 KCLCHKBLK_4 ORA-15042 ORA-15196 ORACLE 12C oracle dul ORACLE PATCH Oracle Recovery Tools oracle加密恢复 oracle勒索 oracle勒索恢复 oracle异常恢复 ORACLE恢复 Oracle 恢复 ORACLE数据库恢复 oracle 比特币 OSD-04016 YOUR FILES ARE ENCRYPTED 勒索恢复 比特币加密文章分类
- Others (2)
- 中间件 (2)
- WebLogic (2)
- 操作系统 (102)
- 数据库 (1,700)
- DB2 (22)
- MySQL (74)
- Oracle (1,561)
- Data Guard (52)
- EXADATA (8)
- GoldenGate (24)
- ORA-xxxxx (159)
- ORACLE 12C (72)
- ORACLE 18C (6)
- ORACLE 19C (15)
- ORACLE 21C (3)
- Oracle 23ai (8)
- Oracle ASM (68)
- Oracle Bug (8)
- Oracle RAC (53)
- Oracle 安全 (6)
- Oracle 开发 (28)
- Oracle 监听 (28)
- Oracle备份恢复 (571)
- Oracle安装升级 (94)
- Oracle性能优化 (62)
- 专题索引 (5)
- 勒索恢复 (81)
- PostgreSQL (18)
- PostgreSQL恢复 (6)
- SQL Server (27)
- SQL Server恢复 (8)
- TimesTen (7)
- 达梦数据库 (2)
- 生活娱乐 (2)
- 至理名言 (11)
- 虚拟化 (2)
- VMware (2)
- 软件开发 (37)
- Asp.Net (9)
- JavaScript (12)
- PHP (2)
- 小工具 (20)
-
最近发表
- Oracle 19c 202501补丁(RUs+OJVM)
- 避免 19c 数据库性能问题需要考虑的事项 (Doc ID 3050476.1)
- Bug 21915719 Database hang or may fail to OPEN in 12c IBM AIX or HPUX Itanium – ORA-742, DEADLOCK or ORA-600 [kcrfrgv_nextlwn_scn] ORA-600 [krr_process_read_error_2]
- ORA-600 ktuPopDictI_1恢复
- impdp导入数据丢失sys授权问题分析
- impdp 创建index提示ORA-00942: table or view does not exist
- 数据泵导出 (expdp) 和导入 (impdp)工具性能降低分析参考
- 19c非归档数据库断电导致ORA-00742故障恢复
- Oracle 19c – 手动升级到 Non-CDB Oracle Database 19c 的完整核对清单
- sqlite数据库简单操作
- Oracle 暂定和恢复功能
- .pzpq扩展名勒索恢复
- Oracle read only用户—23ai新特性:只读用户
- 迁移awr快照数据到自定义表空间
- .hmallox加密mariadb/mysql数据库恢复
- 2025年首个故障恢复—ORA-600 kcbzib_kcrsds_1
- 第一例Oracle 21c恢复咨询
- ORA-15411: Failure groups in disk group DATA have different number of disks.
- 断电引起的ORA-08102: 未找到索引关键字, 对象号 39故障处理
- ORA-00227: corrupt block detected in control file
分类目录归档:Oracle
Oracle 暂定和恢复功能
以前一直没有注意到oracle有暂定和恢复功能(SUSPEND/RESUME)[从oracle 8i开始有的特性],一下是官方描述:
The Database Suspend/Resume feature provides a mechanism by which all disk I/O (datafile, controlfile and file header I/Os) in a database (in all instances) can be suspended making it easier to make a copy of the database. When an ALTER SYSTEM SUSPEND command is issued, it will wait for any ongoing instance recovery to complete and then set a flag in all running instances to stop all new lock and I/O activity. The command may return before the last I/O is issued because the check for the flag might have been before the suspend and the I/O might have been issued after the suspend. So, reads, typically are not allowed when the database is suspended but may still be active for a period of time. However, this command does ensure that no new I/Os will be issued. Once all instances of a database are suspended, a copy of the database can be made by making a copy of all the files (i.e. the control file, online logs and all data files). The copy can have uncommitted updates and therefore the only way a copy of the database can be used in this scenerio is to do an instance recovery and then open it. The database can be suspended or resumed through an ALTER SYSTEM call. You can issue this statement as the user SYSTEM or SYS (the user must have DBA privileges). The syntax for these two commands is as follows: ALTER SYSTEM <options>; <options> = SUSPEND | RESUME | <existing options> The database will remain in the suspended state until the ALTER SYSTEM RESUME command is issued. The database will remain suspended even if the process issuing the ALTER SYSTEM SUSPEND command dies or exists. However, if all instances are shutdown and started again, the database is no longer in a suspended state. The ALTER SYSTEM RESUME command has the effect of blocking the I/O since the SUSPEND command. When the RESUME command is issued, it might cause a burst in the I/O, which may take a while to even out. A message is written to the alert log everytime the database is suspended or resumed, as shown by the example below: Mon Nov 29 11:32:22 1999 Completed: alter database open Wed Dec 1 12:56:53 1999 Starting ORACLE instance (normal) Wed Dec 1 22:03:50 1999 Suspending database following alter system suspend command. Wed Dec 1 22:06:14 1999 Resuming database following alter system resume command. Wed Dec 1 22:07:08 1999 The following is an example of using the SUSPEND and RESUME feature: SVRMGR> connect system/manager Connected. SVRMGR> alter system suspend; Statement processed. SVRMGR> select * from user_source; ^X^Cselect * from user_source ----- (at this stage the statement will just hang. A Ctrl-X Ctrl-C was issued to kill the statement) * ORA-00604: error occurred at recursive SQL level 1 ORA-01013: user requested cancel of current operation SVRMGR> SVRMGR> alter system resume; Statement processed. Considerations and Restrictions: -------------------------------- - The files in the copy database can not be used as backups of the original database for media recovery. (If the direct path option is in use at the time, there may be corrupted blocks). - A new instance cannot be started during the SUSPEND state of the database. If one is started, it will not be included in the SUSPEND process and thus no I/O suspension guarantees are provided in this case. - Creation of backups or archived logs will not be affected by the ALTER SYSTEM SUSPEND command. - The two different commands can be issued from two different instances or processes. - If the SUSPEND command during execution may fail for some reason yet result in some of the instances being suspended, the command can be issued again since the instances in suspend status will ignore the command. - Also database queries will hang when the database is in suspend mode
按照描述SUSPEND 操作会挂起所有io,只要涉及到io操作就会挂起,如果操作的所有请求都可以在内存中完成(buffer cache/shared pool等),那这样的操作是可以直接完成的.
C:\Users\XFF>sqlplus / as sysdba SQL*Plus: Release 11.2.0.4.0 Production on Tue Jan 14 21:51:53 2025 Copyright (c) 1982, 2013, Oracle. All rights reserved. Connected to: Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production With the Partitioning, OLAP, Data Mining and Real Application Testing options SQL> alter system suspend; System altered. SQL> select database_status from v$instance; DATABASE_STATUS ----------------- SUSPENDED SQL> create table t1 as select * from dba_users; create table t1 as select * from dba_users * ERROR at line 1: ORA-00955: name is already used by an existing object SQL> create table t_xff as select * from dba_users; ^C C:\Users\XFF> C:\Users\XFF>sqlplus / as sysdba SQL*Plus: Release 11.2.0.4.0 Production on Tue Jan 14 21:53:19 2025 Copyright (c) 1982, 2013, Oracle. All rights reserved. Connected to: Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production With the Partitioning, OLAP, Data Mining and Real Application Testing options SQL> alter system resume; System altered. SQL> select database_status from v$instance; DATABASE_STATUS ----------------- ACTIVE SQL> create table t_xff as select * from dba_users; Table created. SQL> alter system suspend; System altered. SQL> select count(1) from user$; COUNT(1) ---------- 94 SQL> select count(1) from t_xff; ^C C:\Users\XFF>
在某些情况下,可以通过这类操作来挂起数据库,做一些特殊的操作.
.pzpq扩展名勒索恢复
有一个10g的库,数据库被勒索病毒加密扩展名为:.email=[biobiorans@gmail.com]id=[f5657ac3dc58dc8c].biobio.[backups@airmail.cc].pzpq
#Read-for-recovery.txt文件中内容
Email 1: backups@airmail.cc Email 2: hero77@cock.li Send messages to both emails at the same time So send messages to our emails, check your spam folder every few hours ID: E3DxxxxxxxxxxxxxxxDBB73 If you do not receive a response from us after 24 hours, create a valid email, for example, gmail,outlook Then send us a message with a new email
通过底层对数据库block进行分析,确认损坏的block情况为,头部损坏16个block,中间16个block,尾部16个block
通过Oracle数据文件勒索加密恢复工具,实现快速恢复
然后尝试打开数据库报ORA-600 4193错误
un Jan 12 22:35:09 2025 ALTER DATABASE OPEN Sun Jan 12 22:35:10 2025 Thread 1 opened at log sequence 4 Current log# 3 seq# 4 mem# 0: D:\ORCL\REDO03.LOG Successful open of redo thread 1 Sun Jan 12 22:35:10 2025 MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set Sun Jan 12 22:35:10 2025 SMON: enabling cache recovery Sun Jan 12 22:35:10 2025 Errors in file d:\oracle\product\10.2.0.3\admin\orcl\udump\norcl_ora_2796.trc: ORA-00600: internal error code, arguments: [4193], [58], [52], [], [], [], [], [] Sun Jan 12 22:35:11 2025 Doing block recovery for file 1 block 404 Block recovery from logseq 4, block 73424 to scn 137439548723 Sun Jan 12 22:35:11 2025 Recovery of Online Redo Log: Thread 1 Group 3 Seq 4 Reading mem 0 Mem# 0: D:\ORCL\REDO03.LOG Block recovery stopped at EOT rba 4.73426.16 Block recovery completed at rba 4.73426.16, scn 32.595250 Doing block recovery for file 1 block 9 Block recovery from logseq 4, block 73424 to scn 137439548721 Sun Jan 12 22:35:11 2025 Recovery of Online Redo Log: Thread 1 Group 3 Seq 4 Reading mem 0 Mem# 0: D:\ORCL\REDO03.LOG Block recovery completed at rba 4.73426.16, scn 32.595250 Sun Jan 12 22:35:11 2025 Errors in file d:\oracle\product\10.2.0.3\admin\orcl\udump\norcl_ora_2796.trc: ORA-00604: error occurred at recursive SQL level 1 ORA-00607: Internal error occurred while making a change to a data block ORA-00600: internal error code, arguments: [4193], [58], [52], [], [], [], [], [] Error 604 happened during db open, shutting down database USER: terminating instance due to error 604 Sun Jan 12 22:35:11 2025 Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_pmon_2168.trc: ORA-00604: error occurred at recursive SQL level Sun Jan 12 22:35:12 2025 Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_reco_2688.trc: ORA-00604: error occurred at recursive SQL level Sun Jan 12 22:35:12 2025 Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_smon_2332.trc: ORA-00604: error occurred at recursive SQL level Sun Jan 12 22:35:12 2025 Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_ckpt_2600.trc: ORA-00604: error occurred at recursive SQL level Sun Jan 12 22:35:12 2025 Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_lgwr_2672.trc: ORA-00604: error occurred at recursive SQL level Sun Jan 12 22:35:12 2025 Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_dbw0_1344.trc: ORA-00604: error occurred at recursive SQL level Sun Jan 12 22:35:12 2025 Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_mman_2828.trc: ORA-00604: error occurred at recursive SQL level Sun Jan 12 22:35:12 2025 Errors in file d:\oracle\product\10.2.0.3\admin\orcl\bdump\norcl_psp0_2324.trc: ORA-00604: error occurred at recursive SQL level Instance terminated by USER, pid = 2796 ORA-1092 signalled during: ALTER DATABASE OPEN...
通过分析trace,确认是系统回滚段的free block pool异常,使用bbed进行修复
BBED> clean free_block_pool Clean free block pool completed.you can use dump to verify the data, then can us e sum apply command to save data. BBED> sum apply Warning: apply the modified data will overwrite original data. Would you like to continue? (y/n) y Old checksum value: 0xf2c0 New checksum value: 0xf315 Writing block has completed BBED>
open数据库成功,然后安排导出数据即可
对于类似这种被加密的勒索的数据文件,我们可以实现比较好的恢复效果,如果此类的数据库(oracle,mysql,sql server)等被加密,需要专业恢复技术支持,请联系我们:
电话/微信:17813235971 Q Q:107644445 E-Mail:dba@xifenfei.com
系统安全防护措施建议:
1.多台机器,不要使用相同的账号和口令
2.登录口令要有足够的长度和复杂性,并定期更换登录口令
3.重要资料的共享文件夹应设置访问权限控制,并进行定期备份
4.定期检测系统和软件中的安全漏洞,及时打上补丁。
5.定期到服务器检查是否存在异常。
6.安装安全防护软件,并确保其正常运行。
7.从正规渠道下载安装软件。
8.对不熟悉的软件,如果已经被杀毒软件拦截查杀,不要添加信任继续运行。
9.保存良好的备份习惯,尽量做到每日备份,异地备份。
Oracle read only用户—23ai新特性:只读用户
23ai版本支持用户级别设置read only特性,对于在某些情况下,为了数据的一致性,是一个比较方便的特性,而不是以前版本通过权限控制实现只读,比如授权create session+表/视图等查询权限
下面创建一个用户u_readonly,并授权dba权限,创建一个表进行测试
[oracle@xifenfei ~]$ ss SQL*Plus: Release 23.0.0.0.0 - for Oracle Cloud and Engineered Systems on Sat Jan 11 21:12:09 2025 Version 23.5.0.24.07 Copyright (c) 1982, 2024, Oracle. All rights reserved. Connected to: Oracle Database 23ai Enterprise Edition Release 23.0.0.0.0 - for Oracle Cloud and Engineered Systems Version 23.5.0.24.07 SQL> SQL> select banner from v$version; BANNER -------------------------------------------------------------------------------- Oracle Database 23ai Enterprise Edition Release 23.0.0.0.0 - for Oracle Cloud an d Engineered Systems SQL> show pdbs; CON_ID CON_NAME OPEN MODE RESTRICTED ---------- ------------------------------ ---------- ---------- 2 PDB$SEED READ ONLY NO 3 XIFENFEI MOUNTED SQL> alter session set container=xifenfei; Session altered. SQL> alter database open; Database altered. SQL> create user u_readonly identified by oracle; User created. SQL> grant dba to u_readonly; Grant succeeded. SQL> conn u_readonly/oracle@127.0.0.1/xifenfei Connected. SQL> create table t_xff as select * from dba_objects; Table created. SQL> select count(1) from t_xff; COUNT(1) ---------- 70951
修改用户为只读特性,然后进行dml/ddl操作会报ORA-28194: Can perform read operations only
SQL> conn / as sysdba Connected. SQL> alter session set container=xifenfei; Session altered. SQL> alter user u_readonly read only; User altered. SQL> conn u_readonly/oracle@127.0.0.1/xifenfei Connected. SQL> delete from t_xff; delete from t_xff * ERROR at line 1: ORA-28194: Can perform read operations only SQL> insert into t_xff select * from dba_objects; insert into t_xff select * from dba_objects * ERROR at line 1: ORA-28194: Can perform read operations only SQL> select count(1) from t_xff; COUNT(1) ---------- 70951 SQL> create table t1 as select * from dba_users; create table t1 as select * from dba_users * ERROR at line 1: ORA-28194: Can perform read operations only
直接使用create user命令创建一个只读用户
SQL> conn / as sysdba Connected. SQL> alter session set container=xifenfei; Session altered. SQL> create user u_readonly2 identified by oracle read only; User created. SQL> grant dba to u_readonly2; Grant succeeded. SQL> conn u_readonly2/oracle@127.0.0.1/xifenfei Connected. SQL> create table t_xifenfei as select * from dba_objects; create table t_xifenfei as select * from dba_objects * ERROR at line 1: ORA-28194: Can perform read operations only
修改只读用户为读写模式
SQL> conn / as sysdba Connected. SQL> alter session set container=xifenfei; Session altered. SQL> alter user u_readonly2 read write; User altered. SQL> conn u_readonly2/oracle@127.0.0.1/xifenfei Connected. SQL> create table t_xifenfei as select * from dba_objects; Table created. SQL> delete from t_xifenfei where rownum<100; 99 rows deleted. SQL> commit; Commit complete.
查看用户是否处于只读状态
SQL> select username,read_only from dba_users where created>sysdate-1; USERNAME READ_O ------------------------------ ------ U_READONLY2 NO U_READONLY YES
在只读用户中,使用动态plsql直接直接dml也报ORA-28194: Can perform read operations only
SQL> conn u_readonly/oracle@127.0.0.1/xifenfei Connected. SQL> select count(1) from t_xff; COUNT(1) ---------- 70951 SQL> delete from t_xff; delete from t_xff * ERROR at line 1: ORA-28194: Can perform read operations only SQL> DECLARE 2 v_sql VARCHAR2(1000); 3 BEGIN 4 v_sql := 'delete from t_xff where rownum<1000'; 5 EXECUTE IMMEDIATE v_sql; 6 END; 7 / DECLARE * ERROR at line 1: ORA-28194: Can perform read operations only ORA-06512: at line 5
判断用户是否只读的底层基表属性user$.spare1
SQL> conn / as sysdba Connected. SQL> alter session set container=xifenfei; Session altered. SQL> COL NAME FOR A30 SQL> select name,decode(bitand(spare1, 67108864), 67108864, 'YES', 'NO') 2 read_only from user$ where name like 'U_READONLY%' 3 / NAME READ_O ------------------------------ ------ U_READONLY YES U_READONLY2 NO