最近接到的case.接到客戶報障，xxx資料庫的一個關鍵表資料被誤刪除了，需要做緊急資料恢復。接到客戶報障後，隨後聯絡了開發商的工程師。

一.問題分析,經過與局方和開發商的討論，以及根據系統情況，瞭解到如下資訊。

1.誤刪除的表名為EMP使用者下的EPM_PRO_WORK開頭的表名

2.誤刪除的資料是該表的部分記錄。

3.通過delete方式刪除，誤刪除時間大概上午在9:00至11:00分左右， 綜合以上資訊，因為誤刪的EPM_PRO_WORKPROCESS表的其中一部分記錄，並且是通過delete方式。這種方式適用於通過日誌挖掘的方式做資料恢復，所以採用oracle自身的工具logminer方式做資料恢復。

二 定位被刪除的表名，表名為EPM .EPM_PRO_WORKPROCESS

SQL> select owner,table_name from dba_tables where table_name like ‘%EPM_PRO_WORK%’; OWNER TABLE_NAME —————————— —————————— EPM EPM_PRO_WORKPROCESS EPM EPM_PRO_WORKPROCESS_TEMP EPM_TEST EPM_PRO_WORKPROCESS EPM_TEST EPM_PRO_WORKPROCESS_TEMP EPM2 EPM_PRO_WORKPROCESS_TEMP EPM2 EPM_PRO_WORKPROCESS EPM3 EPM_PRO_WORKPROCESS EPM3 EPM_PRO_WORKPROCESS_TEMP

三 定位關鍵資料被誤刪除時間段所產生的歸檔日誌 SQL> desc V$ARCHIVED_LOG Name Null? Type —————————————– ——– —————————- RECID NUMBER STAMP NUMBER NAME VARCHAR2(513) DEST_ID NUMBER THREAD# NUMBER SEQUENCE# NUMBER RESETLOGS_CHANGE# NUMBER RESETLOGS_TIME DATE FIRST_CHANGE# NUMBER FIRST_TIME DATE NEXT_CHANGE# NUMBER NEXT_TIME DATE BLOCKS NUMBER BLOCK_SIZE NUMBER CREATOR VARCHAR2(7) REGISTRAR VARCHAR2(7) STANDBY_DEST VARCHAR2(3) ARCHIVED VARCHAR2(3) APPLIED VARCHAR2(3) DELETED VARCHAR2(3) STATUS VARCHAR2(1) COMPLETION_TIME DATE DICTIONARY_BEGIN VARCHAR2(3) DICTIONARY_END VARCHAR2(3) END_OF_REDO VARCHAR2(3) BACKUP_COUNT NUMBER ARCHIVAL_THREAD# NUMBER ACTIVATION# NUMBER SQL>alter session set nls_date_format=’yyyy-mm-dd hh24:mi:ss’; SQL>select name,first_time from V$ARCHIVED_LOG where FIRST_TIME > sysdate -1; NAME FIRST_TIME——————————————— ——————-/data1/oracle/archivelog/epmdb/1_4447.dbf 2008-06-01 21:57:34 /data1/oracle/archivelog/epmdb/1_4448.dbf 2008-06-02 01:57:49 /data1/oracle/archivelog/epmdb/1_4449.dbf 2008-06-02 07:00:59 /data1/oracle/archivelog/epmdb/1_4450.dbf 2008-06-02 11:57:57 進一步定位為誤刪時段產生的歸檔日誌為：/data1/oracle/archivelog/epmdb/1_4450.dbf

四通過logminer工具進行日誌分析

1.安裝LogMiner工具，以下兩個指令碼以SYSDBA身份執行 @$ORACLE_HOME/rdbms/admin/dbmslm.sql; @ $ORACLE_HOME/rdbms/admin/dbmslmd.sql;

2.檢查和設定utl_file_dir引數 alter system set utl_file_dir=’/data1’ scope=spfile; shutdown immediate; startup

3.建立資料字典檔案（data-dictionary） sqlplus /nolog SQL> connect /as sysdba SQL> execute dbms_logmnr_d.build(dictionary_filename => ‘dict.ora’,dictionary_location =’/data1′);

4.裝載日誌分析列表 SQL>execute dbms_logmnr.add_logfile(LogFileName => ‘/data1/oracle/archivelog/epmdb/1_4449.dbf’,Options =dbms_logmnr.new); SQL>execute dbms_logmnr.add_logfile(LogFileName => ‘/data1/oracle/archivelog/epmdb/1_4450.dbf’,Options =dbms_logmnr.addfile);

5.開始分析日誌 SQL> execute dbms_logmnr.start_logmnr(startTime => to_date(’20080602090000′,’yyyy-mm-dd hh24:mi:ss’),endTime =to_date(’20080602120000′,’yyyy-mm-dd hh24:mi:ss’),DictFileName =’/data1/dict.ora’);

6.獲取分析結果 create table t3 as select * from v$logmnr_contents; set line 250; col seg_name format a25 col session_info format a10 col OPERATION format a8 col sql_redo format a80 col sql_undo format a80 alter session set nls_date_format=’yyyy-mm-dd hh24:mi:ss’;select timestamp,seg_name,operation,sql_redo,sql_undo from t3 where username=’EPM’ and seg_name=’EPM_PRO_WORKPROCESS’ and OPERATION=’DELETE’;

至此，通過logminer完成了被誤刪資料表的恢復。恢復過程30分鐘左右。

以下為恢復的部分記錄: SQL> / TIMESTAMP SEG_NAME OPERATIO SQL_REDO SQL_UNDO ——————- ————————- ——– ——————————————————————————– ——————————————————————————– 2008-06-02 09:43:24 EPM_PRO_WORKPROCESS DELETE delete from “EPM”.”EPM_PRO_WORKPROCESS” where “PRO_CODE” = ‘C0838K21′ and “PRO_S insert into “EPM”.”EPM_PRO_WORKPROCESS”(”PRO_CODE”,”PRO_SUB_ID”,”REPORTCLASS”,”R UB_ID” IS NULL and “REPORTCLASS” = ‘ 分公司/網路維護中心’ and “REPORTER” = ‘ EPORTER”,”STARTTIME”,”ENDTIME”,”FINISHINVESTION”,”TOTALINVESTIONTHISYEAR”,”TOTAL ‘xxx’ and “STARTTIME” IS NULL and “ENDTIME” IS NULL and “FINISHINVESTION” = ‘0 INVESTION”,”FINISHINVESTIONBYFUND”,”TOTALINVESTIONTHISYEARBYFUND”,”TOTALINVESTIO ‘ and “TOTALINVESTIONTHISYEAR” = ‘0′ and “TOTALINVESTION” = ‘0′ and “FINISHINVES NBYFUND”,”TOTALCONTRACTTHISYEAR”,”TOTALCONTRACT”,”FINISHWORKTHISMONTH”,”TEMPOINF TIONBYFUND” = ‘0′ and “TOTALINVESTIONTHISYEARBYFUND” = ‘0′ and “TOTALINVESTIONBY O”,”REMARKS”,”FINISHINVESTIONBYCONTRACT”,”AUDITSTATUS”,”PROG_ID”,”P_MONTH”,”P_YE FUND” = ‘0′ and “TOTALCONTRACTTHISYEAR” = ‘0′ and “TOTALCONTRACT” = ‘0′ and “FIN AR”,”SEQ_PROG”,”LEVEL_PROG”,”PARENT_PROGID”,”PRO_ID”,”PROCESSINSTID”,”STATUS”) v ISHWORKTHISMONTH” = ‘完成採購請示。經諮詢公司，軟 alues (’C0838K21′,NULL,’ 分公司/網路維護中心’,’ ,NULL,NULL,’0′,’0′,’0′, 件部分用統談分籤方法談判，我方只需等待確認價格後直接與開發商簽訂合同。’ and “TEM ‘0′,’0′,’0′,’0′,’0′,’完成採購請示 要求6月30日前到貨。經諮詢公司，軟 POINFO” IS NULL and “REMARKS” IS NULL and “FINISHINVESTIONBYCONTRACT” = ‘0′ and 件部分用統談分籤方法談判，我方只需等待確認價格後直接與開發商簽訂合同。’,NULL,NUL “AUDITSTATUS” = ‘3′ and “PROG_ID” = ‘5813′ and “P_MONTH” = ‘5′ and “P_YEAR” = ‘2 L,’0′,’3′,’5813′,’5′,’2008′,’0.5813′,’2′,’0′,’1843′,’10793′,’1′); 008′ and “SEQ_PROG” = ‘0.5813′ and “LEVEL_PROG” = ‘2′ and “PARENT_PROGID” = ‘0′ and “PRO_ID” = ‘1843′ and “PROCESSINSTID” = ‘10793′ and “STATUS” = ‘1′ and ROWID = ‘AAAK0OAAMAAADiYAAE’; 2008-06-02 09:43:24 EPM_PRO_WORKPROCESS DELETE delete from “EPM”.”EPM_PRO_WORKPROCESS” where “PRO_CODE” = ‘C0838K23′ and “PRO_S insert into “EPM”.”EPM_PRO_WORKPROCESS”(”PRO_CODE”,”PRO_SUB_ID”,”REPORTCLASS”,”R UB_ID” IS NULL and “REPORTCLASS” = ‘分公司/網路維護中心’ and “REPORTER” = ‘ EPORTER”,”STARTTIME”,”ENDTIME”,”FINISHINVESTION”,”TOTALINVESTIONTHISYEAR”,”TOTAL and “STARTTIME” IS NULL and “ENDTIME” IS NULL and “FINISHINVESTION” = ‘0 INVESTION”,”FINISHINVESTIONBYFUND”,”TOTALINVESTIONTHISYEARBYFUND”,”TOTALINVESTIO ‘ and “TOTALINVESTIONTHISYEAR” = ‘1.42′ and “TOTALINVESTION” = ‘1.42′ and “FINIS NBYFUND”,”TOTALCONTRACTTHISYEAR”,”TOTALCONTRACT”,”FINISHWORKTHISMONTH”,”TEMPOINF HINVESTIONBYFUND” = ‘0′ and “TOTALINVESTIONTHISYEARBYFUND” = ‘0′ and “TOTALINVES O”,”REMARKS”,”FINISHINVESTIONBYCONTRACT”,”AUDITSTATUS”,”PROG_ID”,”P_MONTH”,”P_YE TIONBYFUND” = ‘0′ and “TOTALCONTRACTTHISYEAR” = ‘0′ and “TOTALCONTRACT” = ‘0′ an AR”,”SEQ_PROG”,”LEVEL_PROG”,”PARENT_PROGID”,”PRO_ID”,”PROCESSINSTID”,”STATUS”) v d “FINISHWORKTHISMONTH” = ‘跟進 公司方面直放站軟體升級情況’ and “TEMPOINFO” IS alues (’C0838K23′,NULL,’分公司/網路維護中心’, ,NULL,NULL,’0′,’1.42′,’ NULL and “REMARKS” IS NULL and “FINISHINVESTIONBYCONTRACT” = ‘0′ and “AUDITSTATU 1.42′,’0′,’0′,’0′,’0′,’0′,’跟進公司方面直放站軟體升級情況’,NULL,NULL,’0′,’3′,’ S” = ‘3′ and “PROG_ID” = ‘5812′ and “P_MONTH” = ‘5′ and “P_YEAR” = ‘2008′ and “S 5812′,’5′,’2008′,’0.5812′,’2′,’0′,’1844′,’10792′,’1′); EQ_PROG” = ‘0.5812′ and “LEVEL_PROG” = ‘2′ and “PARENT_PROGID” = ‘0′ and “PRO_ID ” = ‘1844′ and “PROCESSINSTID” = ‘10792′ and “STATUS” = ‘1′ and ROWID = ‘AAAK0OA AMAAADiYAAD’; http://www.ncn.cn/archives/2009/521_snc005