SYSTEM表空間不足的報警

--SYSTEM表空間不足的報警
登錄之後，查詢，發現是sys.aud$佔的地方太多。

SQL> select owner, segment_name, segment_type, sum(bytes)/1024/1024 space_m  
    from dba_segments 
    where tablespace_name = 'SYSTEM' 
group  by owner, segment_name, segment_type
having sum(bytes)/1024/1024 >= 20
order by space_m desc
;
  4    5    6    7  
OWNER    SEGMENT_NAME      SEGMENT_TYPE  SPACE_M
-------- ------------------------------- -------
SYS      AUD$              TABLE            4480
SYS      IDL_UB1$          TABLE             272
SYS      SOURCE$           TABLE              72
SYS      IDL_UB2$          TABLE              32
SYS      C_OBJ#_INTCOL#    CLUSTER            27
SYS      C_TOID_VERSION#   CLUSTER            24

6 rows selected.

SQL>

查看是哪個記得比較多。

col userhost format a30

select userid, userhost, count(1) from sys.aud$ 
where ntimestamp# >=CAST(to_date('2014-03-01 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP) 
group by userid, userhost
having count(1) > 500
order by count(1) desc
;
再繼續找哪天比較多。

select to_char(ntimestamp#, 'YYYY-MM-DD') audit_date,  count(1) 
from sys.aud$ 
where ntimestamp# >=CAST(to_date('2014-03-01 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP) 
and userid = 'xxxx' and userhost = 'xxxx'
group by to_char(ntimestamp#, 'YYYY-MM-DD') 
order by count(1) desc
;
select spare1, count(1)  from sys.aud$ 
where ntimestamp# between CAST(to_date('2014-03-10 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  
and CAST(to_date('2014-03-11 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)
and userid = 'xxxx' and userhost = 'xxxx'
group by spare1
;

select action#, count(1) from sys.aud$ 
where ntimestamp# between CAST(to_date('2014-03-10 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  
and CAST(to_date('2014-03-11 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)
and userid = 'xxxx' and userhost = 'xxxx'
and spare1 = 'xxxx'
group by action#
order by count(1) desc
;

 

結果如下：

   ACTION#   COUNT(1)
---------- ----------
       101     124043
       100     124043
SQL>

其實是上次打開的audit一直沒有關閉。

關閉：

SQL> noaudit session;

清空：

truncate table sys.aud$;

------------------------------------------------------------------------
實戰
------------------------------------------------------------------------
--1,查詢表空間佔用情況
select dbf.tablespace_name as tablespace_name,
         dbf.totalspace as totalspace,
         dbf.totalblocks as totalblocks,
         dfs.freespace freespace,
         dfs.freeblocks freeblocks,
         (dfs.freespace / dbf.totalspace) * 100 as freeRate 
         from (select t.tablespace_name,
         sum(t.bytes) / 1024 / 1024 totalspace,
         sum(t.blocks) totalblocks
         from DBA_DATA_FILES t
         group by t.tablespace_name) dbf,
         (select tt.tablespace_name,
         sum(tt.bytes) / 1024 / 1024 freespace,
         sum(tt.blocks) freeblocks
         from DBA_FREE_SPACE tt
         group by tt.tablespace_name) dfs
         where trim(dbf.tablespace_name) = trim(dfs.tablespace_name)
		 
--2,查看哪裏佔的比較多  SYSTEM 爲step1中查詢 tablespace_name 內容
select owner, segment_name, segment_type, sum(bytes)/1024/1024 space_m  
    from dba_segments 
    where tablespace_name = 'SYSTEM' 
group  by owner, segment_name, segment_type
having sum(bytes)/1024/1024 >= 20
order by space_m desc

--3,查看是哪個記得比較多 count(1) 越大,說明佔得比較多
select userid, userhost, count(1) from sys.aud$ 
where ntimestamp# >=CAST(to_date('2014-03-01 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP) 
group by userid, userhost
having count(1) > 500
order by count(1) desc

--4,再繼續找哪天比較多 userid userhost 爲上一步查詢內容
select to_char(ntimestamp#, 'YYYY-MM-DD') audit_date,  count(1) 
from sys.aud$ 
where ntimestamp# >=CAST(to_date('2015-03-01 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP) 
and userid = 'userid' and userhost = 'userhost'
group by to_char(ntimestamp#, 'YYYY-MM-DD') 
order by count(1) desc
;
select spare1, count(1)  from sys.aud$ 
where ntimestamp# between CAST(to_date('2016-03-10 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  
and CAST(to_date('2016-12-11 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)
and userid = 'userid' and userhost = 'userhost'
group by spare1
;
--spare1 爲上一步查詢內容
select action#, count(1) from sys.aud$ 
where ntimestamp# between CAST(to_date('2016-03-10 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  
and CAST(to_date('2016-12-11 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)
and userid = 'userid' and userhost = 'userhost'
and spare1 = 'Administrator'
group by action#
order by count(1) desc

--5,關閉seeion
noaudit session;
--6,清空：
truncate table sys.aud$;