[20210421]如何使用dumpsga转储sga.txt

来源:这里教程网 时间:2026-03-03 16:37:41 作者:

[20210421]如何使用dumpsga转储sga.txt --//oracle提供一个命令dumpsga转储sga信息,注意别再生产系统乱用这些命令. 1.环境: PORT_STRING                    VERSION        BANNER ------------------------------ -------------- -------------------------------------------------------------------------------- x86_64/Linux 2.4.xx            11.2.0.4.0     Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production $ which dumpsga /u01/app/oracle/product/11.2.0.4/dbhome_1/bin/dumpsga $ dumpsga DUMPSGA_DIR not set or is null. Exiting --//首先需要设置DUMPSGA_DIR,并且该目录需要足够的磁盘空间,保存sga映像,当然前提条件是数据库必须启动。 $ export DUMPSGA_DIR=/u01/tmp $ dumpsga --//这样在/u01/tmp下生成一个目录。 $ ls -l /u01/tmp/ total 3952332 drwxr-x--- 2 oracle oinstall      4096 2021-04-21 10:41:15 Apr_21_10:41:07_2021 --//在该目录下生成一个包含执行dumpsga时间的目录.该目录下包括如下内容: $ ls -l /u01/tmp/Apr_21_10\:41\:07_2021/ total 633464 -rw-rw---- 1 oracle oinstall  12582912 2021-04-21 10:41:07 60000000 -rw-rw---- 1 oracle oinstall 633339904 2021-04-21 10:41:08 60c00000 -rw-rw---- 1 oracle oinstall   2097152 2021-04-21 10:41:15 86800000 -rw-rw---- 1 oracle oinstall      1704 2021-04-21 10:41:15 diagmdata $ ipcs -m ------ Shared Memory Segments -------- key        shmid      owner      perms      bytes      nattch     status 0x00000000 20840450   oracle    640        12582912   25 0x00000000 20873219   oracle    640        633339904  25 0xe8a8ec10 20905988   oracle    640        2097152    25 $ ps -ef | grep smo[n] oracle   19820     1  0 10:32 ?        00:00:00 ora_smon_book $ cat /proc/19820/maps | grep SYSV 60000000-60c00000 rw-s 00000000 00:0b 20840450                           /SYSV00000000 (deleted) 60c00000-86800000 rw-s 00000000 00:0b 20873219                           /SYSV00000000 (deleted) 86800000-86a00000 rw-s 00000000 00:0b 20905988                           /SYSVe8a8ec10 (deleted) --//正好3个共享内存段,dumpsga文件命名时以共享内存段的开始地址来命名。 --//oracle还提供一个mapsga命令,不过我无法使用,注意映射前必须关闭数据库。 --//我的理解这些都是一些黑客工具,实际上mapsga之类的命令如果能力强,自己也可以编写并加载. SYS@book> shutdown immediate; Database closed. Database dismounted. ORACLE instance shut down. $ mapsga Apr_21_10\:41\:07_2021/ Oracle SGA Mapper ================= ORACLE_HOME=/u01/app/oracle/product/11.2.0.4/dbhome_1 ORACLE_SID=book DUMPSGA_DIR=/u01/tmp Mapping SGA dump located in = /u01/tmp/Apr_21_10:41:07_2021/ Failed to remap SGA Error = 17 File exists --//我的测试报错. $ ipcs ------ Shared Memory Segments -------- key        shmid      owner      perms      bytes      nattch     status 0xe8a8ec10 25853954   oracle    660        12582912   0 --//对比前面的输出key=0x00000000,不知道不能加载成功问题在这里. ------ Semaphore Arrays -------- key        semid      owner      perms      nsems ------ Message Queues -------- key        msqid      owner      perms      used-bytes   messages --//仅仅加载了第一个段,就报错退出了,nattch=0说明没有任何进程attach.先删除加载的共享内存段,注意小心!! $ ipcrm -m 25853954 --//再尝试跟踪看看: $ strace mapsga Apr_21_10\:41\:07_2021/ execve("/u01/app/oracle/product/11.2.0.4/dbhome_1/bin/mapsga", ["mapsga", "Apr_21_10:41:07_2021/"], [/* 52 vars */]) = 0 brk(0)                                  = 0x22d2000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb92ccfb000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb92ccfa000 access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/tls/x86_64/libclntsh.so.11.1", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/tls/x86_64", 0x7fffaa47c9c0) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/tls/libclntsh.so.11.1", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/tls", 0x7fffaa47c9c0) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/x86_64/libclntsh.so.11.1", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/x86_64", 0x7fffaa47c9c0) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libclntsh.so.11.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\325G\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=53793394, ...}) = 0 mmap(NULL, 44471752, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fb92a290000 mprotect(0x7fb92c90e000, 2093056, PROT_NONE) = 0 mmap(0x7fb92cb0d000, 1855488, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x267d000) = 0x7fb92cb0d000 mmap(0x7fb92ccd2000, 161224, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb92ccd2000 close(3)                                = 0 open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libnnz11.so", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\326\4\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0644, st_size=7996693, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb92a28f000 mmap(NULL, 3983936, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fb929ec2000 mprotect(0x7fb92a14c000, 1044480, PROT_NONE) = 0 mmap(0x7fb92a24b000, 270336, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x289000) = 0x7fb92a24b000 mmap(0x7fb92a28d000, 6720, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fb92a28d000 close(3)                                = 0 open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/oracm/lib/tls/x86_64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/u01/app/oracle/product/11.2.0.4/dbhome_1/oracm/lib/tls/x86_64", 0x7fffaa47c960) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/oracm/lib/tls/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/u01/app/oracle/product/11.2.0.4/dbhome_1/oracm/lib/tls", 0x7fffaa47c960) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/oracm/lib/x86_64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/u01/app/oracle/product/11.2.0.4/dbhome_1/oracm/lib/x86_64", 0x7fffaa47c960) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/oracm/lib/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/u01/app/oracle/product/11.2.0.4/dbhome_1/oracm/lib", 0x7fffaa47c960) = -1 ENOENT (No such file or directory) open("/lib/tls/x86_64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/lib/tls/x86_64", 0x7fffaa47c960) = -1 ENOENT (No such file or directory) open("/lib/tls/libdl.so.2", O_RDONLY)   = -1 ENOENT (No such file or directory) stat("/lib/tls", 0x7fffaa47c960)        = -1 ENOENT (No such file or directory) open("/lib/x86_64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/lib/x86_64", 0x7fffaa47c960)     = -1 ENOENT (No such file or directory) open("/lib/libdl.so.2", O_RDONLY)       = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p\252|G4\0\0\0"..., 832) = 832 close(3)                                = 0 stat("/lib", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 open("/usr/lib/tls/x86_64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/lib/tls/x86_64", 0x7fffaa47c960) = -1 ENOENT (No such file or directory) open("/usr/lib/tls/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/lib/tls", 0x7fffaa47c960)    = -1 ENOENT (No such file or directory) open("/usr/lib/x86_64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/lib/x86_64", 0x7fffaa47c960) = -1 ENOENT (No such file or directory) open("/usr/lib/libdl.so.2", O_RDONLY)   = -1 ENOENT (No such file or directory) stat("/usr/lib", {st_mode=S_IFDIR|0755, st_size=36864, ...}) = 0 open("/usr/local/lib/tls/x86_64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/tls/x86_64", 0x7fffaa47c960) = -1 ENOENT (No such file or directory) open("/usr/local/lib/tls/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/tls", 0x7fffaa47c960) = -1 ENOENT (No such file or directory) open("/usr/local/lib/x86_64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/local/lib/x86_64", 0x7fffaa47c960) = -1 ENOENT (No such file or directory) open("/usr/local/lib/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/local/lib", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 open("/lib64/tls/x86_64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/lib64/tls/x86_64", 0x7fffaa47c960) = -1 ENOENT (No such file or directory) open("/lib64/tls/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/lib64/tls", 0x7fffaa47c960)      = -1 ENOENT (No such file or directory) open("/lib64/x86_64/libdl.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/lib64/x86_64", 0x7fffaa47c960)   = -1 ENOENT (No such file or directory) open("/lib64/libdl.so.2", O_RDONLY)     = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\16\200\2317\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=23360, ...}) = 0 mmap(0x3799800000, 2109696, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3799800000 mprotect(0x3799802000, 2097152, PROT_NONE) = 0 mmap(0x3799a02000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x3799a02000 close(3)                                = 0 open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib/libm.so.6", O_RDONLY)        = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\20D}G4\0\0\0"..., 832) = 832 close(3)                                = 0 open("/usr/lib/libm.so.6", O_RDONLY)    = -1 ENOENT (No such file or directory) open("/usr/local/lib/libm.so.6", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib64/libm.so.6", O_RDONLY)      = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`>\300\3122\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=614992, ...}) = 0 mmap(0x32cac00000, 2629816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x32cac00000 mprotect(0x32cac82000, 2093056, PROT_NONE) = 0 mmap(0x32cae81000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x81000) = 0x32cae81000 close(3)                                = 0 open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib/libpthread.so.0", O_RDONLY)  = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0p({G4\0\0\0"..., 832) = 832 close(3)                                = 0 open("/usr/lib/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory) open("/usr/local/lib/libpthread.so.0", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib64/libpthread.so.0", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340W\0\2327\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=149968, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb929ec1000 mmap(0x379a000000, 2208624, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x379a000000 mprotect(0x379a016000, 2097152, PROT_NONE) = 0 mmap(0x379a216000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x16000) = 0x379a216000 mmap(0x379a218000, 13168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x379a218000 close(3)                                = 0 open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib/libnsl.so.1", O_RDONLY)      = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@\361\34H4\0\0\0"..., 832) = 832 close(3)                                = 0 open("/usr/lib/libnsl.so.1", O_RDONLY)  = -1 ENOENT (No such file or directory) open("/usr/local/lib/libnsl.so.1", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib64/libnsl.so.1", O_RDONLY)    = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240@@\2347\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=114352, ...}) = 0 mmap(0x379c400000, 2194096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x379c400000 mprotect(0x379c415000, 2093056, PROT_NONE) = 0 mmap(0x379c614000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14000) = 0x379c614000 mmap(0x379c616000, 6832, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x379c616000 close(3)                                = 0 open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib/libc.so.6", O_RDONLY)        = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0PfG4\0\0\0"..., 832) = 832 close(3)                                = 0 open("/usr/lib/libc.so.6", O_RDONLY)    = -1 ENOENT (No such file or directory) open("/usr/local/lib/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib64/libc.so.6", O_RDONLY)      = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300\332\1\2317\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=1726320, ...}) = 0 mmap(0x3799000000, 3506520, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x3799000000 mprotect(0x379914f000, 2097152, PROT_NONE) = 0 mmap(0x379934f000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14f000) = 0x379934f000 mmap(0x3799354000, 16728, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x3799354000 close(3)                                = 0 open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libaio.so.1", O_RDONLY) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libaio.so.1", O_RDONLY) = -1 ENOENT (No such file or directory) open("/u01/app/oracle/product/11.2.0.4/dbhome_1/lib/libaio.so.1", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib/libaio.so.1", O_RDONLY)      = -1 ENOENT (No such file or directory) open("/usr/lib/libaio.so.1", O_RDONLY)  = 3 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\220\3\0\0004\0\0\0"..., 832) = 832 close(3)                                = 0 open("/usr/local/lib/libaio.so.1", O_RDONLY) = -1 ENOENT (No such file or directory) open("/lib64/libaio.so.1", O_RDONLY)    = -1 ENOENT (No such file or directory) open("/usr/lib64/tls/x86_64/libaio.so.1", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/lib64/tls/x86_64", 0x7fffaa47c760) = -1 ENOENT (No such file or directory) open("/usr/lib64/tls/libaio.so.1", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/lib64/tls", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 open("/usr/lib64/x86_64/libaio.so.1", O_RDONLY) = -1 ENOENT (No such file or directory) stat("/usr/lib64/x86_64", 0x7fffaa47c760) = -1 ENOENT (No such file or directory) open("/usr/lib64/libaio.so.1", O_RDONLY) = 3 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\5\0\0\0\0\0\0"..., 832) = 832 fstat(3, {st_mode=S_IFREG|0755, st_size=3768, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb929ec0000 mmap(NULL, 2099744, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fb929cbf000 mprotect(0x7fb929cc0000, 2093056, PROT_NONE) = 0 mmap(0x7fb929ebf000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0) = 0x7fb929ebf000 close(3)                                = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb929cbe000 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb929cbd000 arch_prctl(ARCH_SET_FS, 0x7fb929cbd6e0) = 0 mprotect(0x379934f000, 16384, PROT_READ) = 0 mprotect(0x379c614000, 4096, PROT_READ) = 0 mprotect(0x379a216000, 4096, PROT_READ) = 0 mprotect(0x32cae81000, 4096, PROT_READ) = 0 mprotect(0x3799a02000, 4096, PROT_READ) = 0 mprotect(0x3798e1c000, 4096, PROT_READ) = 0 set_tid_address(0x7fb929cbd770)         = 20005 set_robust_list(0x7fb929cbd780, 0x18)   = 0 futex(0x7fffaa47d51c, FUTEX_WAKE_PRIVATE, 1) = 0 rt_sigaction(SIGRTMIN, {0x379a0053c0, [], SA_RESTORER|SA_SIGINFO, 0x379a00eca0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {0x379a0052f0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x379a00eca0}, NULL, 8) = 0 rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0 fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 2), ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb929cbc000 write(1, "Oracle SGA Mapper\n", 18Oracle SGA Mapper )     = 18 write(1, "=================\n", 18================= )     = 18 write(1, "ORACLE_HOME=/u01/app/oracle/prod"..., 54ORACLE_HOME=/u01/app/oracle/product/11.2.0.4/dbhome_1 ) = 54 write(1, "ORACLE_SID=book\n", 16ORACLE_SID=book )       = 16 write(1, "DUMPSGA_DIR=/u01/tmp\n", 21DUMPSGA_DIR=/u01/tmp )  = 21 write(1, "Mapping SGA dump located in = /u"..., 61Mapping SGA dump located in = /u01/tmp/Apr_21_10:41:07_2021/ ) = 61 brk(0)                                  = 0x22d2000 brk(0x22f3000)                          = 0x22f3000 open("/u01/tmp/Apr_21_10:41:07_2021//diagmdata", O_RDWR|O_SYNC) = 3 read(3, "/u01/tmp/Apr_21_10:41:07_2021\0\0\0"..., 1560) = 1560 read(3, "\3\0\0\0\0\0\0\0\0\0\300\0\0\0\0\0\0\0\0\0\2\0>\1\0\0\300\0\0\0\0\0"..., 144) = 144 close(3)                                = 0 open("/u01/tmp/Apr_21_10:41:07_2021/60000000", O_RDWR|O_CREAT|O_SYNC, 0660) = 3 shmget(0xe8a8ec10, 12582912, IPC_CREAT|IPC_EXCL|SHM_HUGETLB|0) = 25886722 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~//加载ok。按照前面的输出 --//key=0x00000000 shmctl(25886722, IPC_STAT, 0x7fffaa47cb98) = -1 EACCES (Permission denied) getuid()                                = 502 getgid()                                = 502 shmctl(25886722, IPC_SET, 0x7fffaa47cb98) = 0 shmat(25886722, 0x60000000, 0x180 /* SHM_??? */) = ? read(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 12582912) = 12582912 close(3)                                = 0 open("/u01/tmp/Apr_21_10:41:07_2021/60c00000", O_RDWR|O_CREAT|O_SYNC, 0660) = 3 shmget(0xe8a8ec10, 633339904, IPC_CREAT|IPC_EXCL|SHM_HUGETLB|0) = -1 EEXIST (File exists) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~//这里存在错误,因为shmget第1个参数0xe8a8ec10,前面已经加载(注这是我的猜测)。 close(3)                                = 0 write(1, "Failed to remap SGA\n", 20Failed to remap SGA )   = 20 write(1, "Error = 17 File exists\n", 23Error = 17 File exists ) = 23 exit_group(0)                           = ? --//也许在10g下可以通过,只要段定义足够大,仅仅出现一个段,11g下被分成至少3个段。 --//不过有了这个sga映像还是能知道许多信息,比如可以探查oracle的口令字符串,通过下面的测试说明: SYS@book> select * from user$ where name='SYSTEM'   2  @ prxx ============================== USER#                         : 5 NAME                          : SYSTEM TYPE#                         : 1 PASSWORD                      : 2D594E86F93B17A1 DATATS#                       : 0 TEMPTS#                       : 3 CTIME                         : 2013-08-24 11:37:40 PTIME                         : 2017-02-03 16:39:59 EXPTIME                       : 2016-08-24 11:45:42 LTIME                         : 2013-08-24 12:07:04 RESOURCE$                     : 0 AUDIT$                        : DEFROLE                       : 1 DEFGRP#                       : DEFGRP_SEQ#                   : ASTATUS                       : 0 LCOUNT                        : 0 DEFSCHCLASS                   : DEFAULT_CONSUMER_GROUP EXT_USERNAME                  : SPARE1                        : 0 SPARE2                        : SPARE3                        : SPARE4                        : S:1E9BC408B7D96D495E0098F1E70FAEB7065BC203B03049D487728443FB41 SPARE5                        : SPARE6                        : PL/SQL procedure successfully completed. --//只要检索DEFAULT_CONSUMER_GROUP 估计前面后面几行就是口令的字符串。 $ strings 60c00000 | grep -A10 SYSTEM | grep -A10 DEFAULT_CONSUMER_GROUP | grep "S:"| sort | uniq -c       9 >S:1E9BC408B7D96D495E0098F1E70FAEB7065BC203B03049D487728443FB41l       3 >S:574F64CF334589628C7754569B8C88C0A2000C907997A2E079AD97B2B0E3l       1 >S:757313FFE2E6EF9A6335E271A6AC31A5183587AB5A50C8C99611A375F95El       1 >S:9D0352F4707B0EEF41811E091AF4731E609EDFDD80ABD412B06B2A257529       1 >S:D1C72E475ADEC14CC69D55A325D4D7C0B4373D0897DDF692B1467F53438Dl --//结尾的字符是 l 对应ascii 6c,实际上是下一条记录的flag.噢这个表在cluster上,我自己以前没注意。 --//开头的字符是 > 对应ascii 3e,表示字符串长度.0x3e = 62,截取 --//S:1E9BC408B7D96D495E0098F1E70FAEB7065BC203B03049D487728443FB41 正好62个字符。 --//基本可以猜测口令的字符串就是S:1E9BC408B7D96D495E0098F1E70FAEB7065BC203B03049D487728443FB41,当然口令复杂破解需要一定 --//难度的,此处省略... $ strings -td 60c00000 | grep -A10 SYSTEM | grep -A10 DEFAULT_CONSUMER_GROUP | grep "S:1E9BC408B7D96D495E0098F1E70FAEB7065BC203B03049D487728443FB41l"  | awk '{print $1}' | xargs -IQ bash -c "echo Q/8192| bc -l " 51844.40917968750000000000 51844.43017578125000000000 51844.45104980468750000000 51844.47204589843750000000 51844.49291992187500000000 51844.51391601562500000000 51844.53479003906250000000 51844.55578613281250000000 51844.57666015625000000000 --//注:我在后面使用bbed观察时发生错误,应该对应的块是51845,再此先做一个说明。 --//都在同一个块出现,为什么出现多次,因为我很少使用system登录,偶尔会出现输错口令的情况。比如输入错口令后LCOUNT增加: SYS@book> select LCOUNT from user$ where name='SYSTEM';     LCOUNT ----------          0 $ rlsql -s -l system/aaaa ERROR: ORA-01017: invalid username/password; logon denied SP2-0751: Unable to connect to Oracle.  Exiting SQL*Plus SYS@book> select LCOUNT from user$ where name='SYSTEM';     LCOUNT ----------          1 SYS@book> select dump(0,16) ,dump(1,16) from dual ; DUMP(0,16)      DUMP(1,16) --------------- ----------------- Typ=2 Len=1: 80 Typ=2 Len=2: c1,2 --//LCOUNT字段被修改,从0->1,oracle number编码从80->c102,长度发生了变化。这样oracle需要重新设置kdbr的指针。在一个块里出现多 --//次就正常了。 --//我通过bbed验证出现问题,我开始以为是blocksize识别问题,实际上探查的块应该是51845. BBED> set filename '/u01/tmp/book/60c00000'         FILENAME        /u01/tmp/book/60c00000 BBED> show all         FILE#           100         BLOCK#          51844         OFFSET          7612         DBA             0x1900ca84 (419482244 100,51844)         FILENAME        /u01/tmp/book/60c00000         BIFILE          bifile.bbd         LISTFILE        /home/oracle/bbed/filelist.txt         BLOCKSIZE       512 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=>识别为512.         MODE            Edit         EDIT            Unrecoverable         IBASE           Dec         OBASE           Dec         WIDTH           300         COUNT           64         LOGFILE         log.bbd         SPOOL           Yes BBED> set blocksize 8192         BLOCKSIZE       8192 BBED> set block 51844         BLOCK#          51844 BBED> x /rncncnnttttncnnnnnccnnncct *kdbr[5] rowdata[242]                                @7612 ------------ flag@7612: 0x2c (KDRHFL, KDRHFF, KDRHFH) lock@7613: 0x00 cols@7614:   15 --//注:我这里没有意识到user$在cluser上。 col    0[2] @7615: 6 col    1[4] @7618: book col    2[6] @7623: 1062280681 col    3[4] @7630: book col    4[7] @7635: ######################################### col    5[6] @7643: 3631320093 col    6[0] @7650: *NULL* col    7[0] @7651: *NULL* col    8[0] @7652: *NULL* col    9[0] @7653: *NULL* col   10[0] @7654: *NULL* col   11[0] @7655: *NULL* col   12[0] @7656: *NULL* col   13[0] @7657: *NULL* col   14[2] @7658: 8 --//看到的信息是不是对应的块。 $ dd if=60c00000 of=51844.dd count=1 bs=8192 skip=51844 conv=notrunc 1+0 records in 1+0 records out 8192 bytes (8.2 kB) copied, 7.4208e-05 seconds, 110 MB/s --//bebd观察: BBED> set filename '/u01/tmp/book/51844.dd'         FILENAME        /u01/tmp/book/51844.dd BBED> set blocksize 8192         BLOCKSIZE       8192 BBED> set block 1         BLOCK#          1 BBED> p kdbt struct kdbt[0], 4 bytes                     @106    sb2 kdbtoffs                             @106      0    sb2 kdbtnrow                             @108      21 struct kdbt[1], 4 bytes                     @110    sb2 kdbtoffs                             @110      21    sb2 kdbtnrow                             @112      22 --//应该是cluster表,有2个表存在。21+6 = 27 BBED> x /rcncnnttttncnnnnnccnnncct *kdbr[27] rowdata[0]                                  @3244 ---------- flag@3244: 0x6c (KDRHFL, KDRHFF, KDRHFH, KDRHFC) lock@3245: 0x00 cols@3246:   22 ckix@3247:    5 col    0[6] @3248: SYSTEM col    1[2] @3255: 1 col   2[16] @3258: 2D594E86F93B17A1 col    3[1] @3275: 0 col    4[2] @3277: 3 col    5[7] @3280: 2013-08-24 11:37:40 col    6[7] @3288: 2017-02-03 16:39:59 col    7[7] @3296: 2016-08-24 11:45:42 col    8[7] @3304: 2013-08-24 12:07:04 col    9[1] @3312: 0 col   10[0] @3314: *NULL* col   11[2] @3315: 1 col   12[0] @3318: *NULL* col   13[0] @3319: *NULL* col   14[1] @3320: 0 col   15[1] @3322: 0 col  16[22] @3324: DEFAULT_CONSUMER_GROUP col   17[0] @3347: *NULL* col   18[1] @3348: 0 col   19[0] @3350: *NULL* col   20[0] @3351: *NULL* col  21[62] @3352: S:1E9BC408B7D96D495E0098F1E70FAEB7065BC203B03049D487728443FB41 --//正好对应前面的显示。噢也明白了我前面为什么犯错。应该在块51845,自己搞错了,写的有点乱,不多这样能记录我当时的分析思考 --//过程以及错误。 --//补充说明实际上这个问题在于60c00000的第0块无法识别为数据文件的OS块。这样跟windows下使用bbed一样,要探究的block要+1才行。 BBED> set filename '/u01/tmp/book/60c00000'         FILENAME        /u01/tmp/book/60c00000 BBED> set blocksize 8192         BLOCKSIZE       8192 BBED> set block 51845         BLOCK#          51845 BBED> x /rcncnnttttncnnnnnccnnncct *kdbr[27] rowdata[0]                                  @3244 ---------- flag@3244: 0x6c (KDRHFL, KDRHFF, KDRHFH, KDRHFC) lock@3245: 0x00 cols@3246:   22 ckix@3247:    5 col    0[6] @3248: SYSTEM col    1[2] @3255: 1 col   2[16] @3258: 2D594E86F93B17A1 col    3[1] @3275: 0 col    4[2] @3277: 3 col    5[7] @3280: 2013-08-24 11:37:40 col    6[7] @3288: 2017-02-03 16:39:59 col    7[7] @3296: 2016-08-24 11:45:42 col    8[7] @3304: 2013-08-24 12:07:04 col    9[1] @3312: 0 col   10[0] @3314: *NULL* col   11[2] @3315: 1 col   12[0] @3318: *NULL* col   13[0] @3319: *NULL* col   14[1] @3320: 0 col   15[1] @3322: 0 col  16[22] @3324: DEFAULT_CONSUMER_GROUP col   17[0] @3347: *NULL* col   18[1] @3348: 0 col   19[0] @3350: *NULL* col   20[0] @3351: *NULL* col  21[62] @3352: S:1E9BC408B7D96D495E0098F1E70FAEB7065BC203B03049D487728443FB41

相关推荐