[20150505]关于alert.log文件.txt

2021-09-24 15:03:31

--alert.log文件记录系统报警信息以及关键记录,对于数据库的诊断很有帮助.
--我记得以前有过一次经历使用vim,不小心编辑了alert文件,导致后续的日志信息无法追加到文件中.

--实际上这个因为编辑保存后,文件inode发生了变化.而出现这样的情况.

1.先来看看10g的情况:

SCOTT@test> @ &r/ver1
PORT_STRING VERSION BANNER
------------------------------ -------------- ----------------------------------------------------------------
x86_64/Linux 2.4.xx 10.2.0.4.0 Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - 64bi

SCOTT@test> @ &r/spid

SID SERIAL# SPID C50
------------ ------------ ------ --------------------------------------------------
157 7 26687 alter system kill session '157,7' immediate;

$ ls -l /proc/26687/fd | grep -i alert
--无显示!

SCOTT@test> alter system archive log current ;
System altered.

$ ls -l /proc/26687/fd | grep -i alert
lr-x------ 1 oracle oinstall 64 2015-05-05 08:13:45 6 -> /u01/app/oracle/admin/test/bdump/alert_test.log

--可以发现在执行alter system archive log current ;后,打开了alert*.log文件.

# lsof | grep -E 'alert_test.log|PID'
COMMAND     PID        USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
oracle    26476      oracle    6w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle    26476      oracle    8w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle    26478      oracle    6w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle    26478      oracle    8w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle    26480      oracle    6w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle    26480      oracle    8w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle    26482      oracle    6w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle    26482      oracle    8w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle    26484      oracle    6w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle    26484      oracle    8w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log
...
--如果仔细检查这个系统进程PID,可以发现大部分是后台进程.

# ps -ef | grep "ora_dbw0_test" | grep -v grep
oracle 26482 1 0 08:04 ? 00:00:00 ora_dbw0_test

--也就是讲在数据库启动后,alert*.log的文件句柄就打开了.如果不小心编辑,导致文件inode变化,导致无法追加日志.
--注意mv并不会改变文件的inode信息.
--我做一个mv例子:

$ ls -il alert_test.log
37093990 -rw-r----- 1 oracle oinstall 1497201 2015-05-05 08:14:16 alert_test.log

$ mv alert_test.log alert_test.log_xxx
$ ls -il alert_test.log_xxx
37093990 -rw-r----- 1 oracle oinstall 1497201 2015-05-05 08:14:16 alert_test.log_xxx

--可以发现前面的数字37093990是文件的inode号,没有变化.

# lsof | grep -E 'alert_test.log|PID'
COMMAND     PID        USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
oracle    26476      oracle    6w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx
oracle    26476      oracle    8w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx
oracle    26478      oracle    6w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx
oracle    26478      oracle    8w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx
oracle    26480      oracle    6w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx
oracle    26480      oracle    8w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx
oracle    26482      oracle    6w      REG                8,3   1497201   37093990 /u01/app/oracle/admin/test/bdump/alert_test.log_xxx

---可以发现这些文件系统指向新的文件名.
---在前面的会话执行alter system archive log current ;会出现什么情况呢?
$ ls -l /proc/26687/fd | grep -i alert
lr-x------ 1 oracle oinstall 64 2015-05-05 08:13:45 6 -> /u01/app/oracle/admin/test/bdump/alert_test.log

--有建立新的alert文件并打开新的句柄.

# lsof | grep -E 'alert_test.log$|PID'
COMMAND     PID        USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
oracle    26488      oracle    8w      REG                8,3       459   37094613 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle    26490      oracle    8w      REG                8,3       459   37094613 /u01/app/oracle/admin/test/bdump/alert_test.log
oracle    26687      oracle    6r      REG                8,3       459   37094613 /u01/app/oracle/admin/test/bdump/alert_test.log

# ps -ef | grep -E "26488|26490|26687" | grep -v grep
oracle   26488     1 0 08:04 ?        00:00:00 ora_lgwr_test
oracle   26490     1 0 08:04 ?        00:00:00 ora_ckpt_test
oracle   26687 26686 0 08:12 ?        00:00:00 oracletest (DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))

--如果你使用vim编辑看看,可以发现inode发生了变化.
$ ls -li alert_test.log
37095477 -rw-r----- 1 oracle oinstall 804 2015-05-05 08:37:08 alert_test.log

# lsof | grep -E 'alert_test.log|PID' | grep delete
oracle 26488 oracle 8w REG 8,3 805 37095459 /u01/app/oracle/admin/test/bdump/alert_test.log~ (deleted)
oracle 26687 oracle 6r REG 8,3 459 37094613 /u01/app/oracle/admin/test/bdump/alert_test.log~ (deleted)

--总之最好不好选择查看时,不要选择保存,最好选择view模式.

2.再来看看11g的情况:

SYS@test> @ver1
PORT_STRING VERSION BANNER
------------------------------ -------------- --------------------------------------------------------------------------------
x86_64/Linux 2.4.xx 11.2.0.3.0 Oracle Database 11g Enterprise Edition Release 11.2.0.3.0 - 64bit Production

# lsof | grep -i alert
--竟然没有输出.

SCOTT@test> @spid
SID SERIAL# SPID C50
---------- ---------- ------ --------------------------------------------------
580 7 3879 alter system kill session '580,7' immediate;

SCOTT@test> alter system archive log current ;
System altered.

# ls -l /proc/3879/fd | grep alert
--竟然没有输出.

# lsof | grep -i alert
--竟然没有输出.

--换一句讲,在写alert*.log完成后,关闭了句柄.
--这样即使编辑文件等各种操作,基本不会导致日志的丢失.

3.当然11G rac下又是不同的情况:
# lsof | grep -E "alert_|PID"
COMMAND      PID   USER   FD      TYPE             DEVICE SIZE/OFF       NODE NAME
java       20101   root   60r      REG              252,3    212216   10764708 /u01/app/grid/diag/asm/+asm/+ASM2/trace/alert_+ASM2.log
java       20101   root   61r      REG              252,3 16654048   12142756 /u01/app/oracle/diag/rdbms/dben/dben2/trace/alert_dben2.log
java       20101   root   63r      REG              252,3 409450857   12125590 /u01/app/oracle/diag/rdbms/dbcn/dbcn2/trace/alert_dbcn2.log

# ps -ef | grep 20101
root      20101      1 1 2014 ?        1-12:14:54 /u01/app/11.2.0.4/grid/jdk/jre/bin/java -Xms128m -Xmx512m -classpath
                                                    /u01/app/11.2.0.4/grid/tfa/dm01dbadm02/tfa_home/jlib/RATFA.jar:
                                                    /u01/app/11.2.0.4/grid/tfa/dm01dbadm02/tfa_home/jlib/je-5.0.84.jar:
                                                    /u01/app/11.2.0.4/grid/tfa/dm01dbadm02/tfa_home/jlib/ojdbc6.jar:
                                                    /u01/app/11.2.0.4/grid/tfa/dm01dbadm02/tfa_home/jlib/commons-io-2.2.jar oracle.rat.tfa.TFAMain
                                                    /u01/app/11.2.0.4/grid/tfa/dm01dbadm02/tfa_home

--这个是tfa的东东,好像以读的方式打开.看来11G已经发生了变化,打开读写完成后,会关闭alert文件的句柄.

码农公寓

相关文章