聯繫：手機/微信(+86 17813235971) QQ(107644445)
標題：DBV-00107: Unknown header format 故障處理
作者：惜分飛©版權所有[未經本人同意,不得以任何形式轉載,否則有進一步追究法律責任的權利.]
客戶linux平臺被勒索病毒加密,其中有oracle數據庫.客戶聯繫黑客進行解密【勒索解密oracle失敗】,但是數據庫無法正常啓動,dbv檢查數據庫文件報錯
[oracle@hisdb ~]$ dbv file=system01.dbfDBVERIFY: Release 11.2.0.1.0 - Production on 星期一 11月 27 21:49:17 2023Copyright (c) 1982, 2009, Oracle and/or its affiliates. All rights reserved.DBV-00107: 未知標頭格式 (31) (287942924) |
對應的英文爲:DBV-00107: Unknown header format (31) (287942924)，檢查數據文件信息發現提示爲 FILE NOT FOUND,使用腳本爲:Oracle數據庫異常恢復檢查腳本(Oracle Database Recovery Check)檢測結果
通過分區確認是文件頭損壞
修復正確的文件頭
再次dbv檢查數據文件
[oracle@hisdb ~]$ dbv file=system01.dbfDBVERIFY: Release 11.2.0.1.0 - Production on 星期一 11月 27 22:05:41 2023Copyright (c) 1982, 2009, Oracle and/or its affiliates. All rights reserved.DBVERIFY - 開始驗證: FILE = /u01/app/oracle/oradata/system01.dbf頁 12800 標記爲損壞Corrupt block relative dba: 0x00403200 (file 1, block 12800)Bad header found during dbv:Data in bad block: type: 88 format: 1 rdba: 0x33877808 last change scn: 0x257a.7b3a44e3 seq: 0xe8 flg: 0xe6 spare1: 0x4e spare2: 0x73 spare3: 0x0 consistency value in tail: 0x65251001 check value in block header: 0xc3b4 computed block checksum: 0x4ca7DBVERIFY - 驗證完成檢查的頁總數: 13440處理的頁總數 (數據): 3297失敗的頁總數 (數據): 0處理的頁總數 (索引): 2097失敗的頁總數 (索引): 0處理的頁總數 (其他): 1441處理的總頁數 (段) : 1失敗的總頁數 (段) : 0空的頁總數: 6604標記爲損壞的總頁數: 1流入的頁總數: 0加密的總頁數 : 0最高塊 SCN : 1667927064 (12.1667927064) |
修復其他文件頭,並dbv檢查,發現均在12800位置損壞.嘗試recover database恢復數據庫,報ORA-00742 ORA-00312之類錯誤.
Sat Nov 25 17:03:39 2023ALTER DATABASE RECOVER database Media Recovery Start started logmerger processParallel Media Recovery started with 40 slavesSat Nov 25 17:03:40 2023Recovery of Online Redo Log: Thread 1 Group 7 Seq 27220 Reading mem 0 Mem# 0: /u01/app/oracle/oradata/redo07.logSat Nov 25 17:03:41 2023Hex dump of (file 3, block 7) in trace file /u01/app/oracle/diag/rdbms/his/his/trace/his_pr0l_52669.trcCorrupt block relative dba: 0x00c00007 (file 3, block 7)Bad header found during media recoveryData in bad block: type: 124 format: 7 rdba: 0x1698b845 last change scn: 0x4fa1.3eaa638f seq: 0x6 flg: 0x24 spare1: 0x26 spare2: 0x42 spare3: 0x0 consistency value in tail: 0xa39e1e01 check value in block header: 0x2ca4 computed block checksum: 0x3b25Reading datafile '/u01/app/oracle/oradata/undotbs01.dbf' for corruption at rdba: 0x00c00007 (file 3, block 7)Reread (file 3, block 7) found same corrupt data (no logical check)Sat Nov 25 17:03:41 2023Hex dump of (file 46, block 3) in trace file /u01/app/oracle/diag/rdbms/his/his/trace/his_pr0w_52691.trcCorrupt block relative dba: 0x0b800003 (file 46, block 3)Bad header found during media recoveryData in bad block: type: 7 format: 7 rdba: 0x77922022 last change scn: 0xdff3.c40df5b6 seq: 0x6f flg: 0xe5 spare1: 0xcd spare2: 0x6d spare3: 0x83d7 consistency value in tail: 0x63c63d2c check value in block header: 0xf662 computed block checksum: 0xec49Data in bad block: type: 135 format: 4 rdba: 0x45ad2864 last change scn: 0x9d7e.34949c73 seq: 0x32 flg: 0x3e spare1: 0x89 spare2: 0x0 spare3: 0x9f9f consistency value in tail: 0xa5807800 check value in block header: 0xb2c9 computed block checksum: 0x3aeaReread (file 5, block 11259) found same corrupt data (no logical check) type: 214 format: 1 rdba: 0x0228dbe9Bad header found during media recovery last change scn: 0xed57.ca4f7559 seq: 0x9b flg: 0x4aData in bad block: spare1: 0x97 spare2: 0x77 spare3: 0x2bab type: 33 format: 6 rdba: 0x018d584a consistency value in tail: 0x359f90d6 last change scn: 0xaeb8.2fa361eb seq: 0x60 flg: 0x92 check value in block header: 0x6b26 spare1: 0xea spare2: 0xe spare3: 0xb405 block checksum disabledReread (file 3, block 4) found same corrupt data (no logical check)Corrupt block relative dba: 0x0b800e61 (file 46, block 3681)Bad header found during media recoveryData in bad block: type: 131 format: 6 rdba: 0xc7edd0fc last change scn: 0xd319.d0e54941 seq: 0x6f flg: 0x6d spare1: 0xe7 spare2: 0x82 spare3: 0x439f consistency value in tail: 0x18dc47b6 check value in block header: 0xe9c8 computed block checksum: 0x204dReread (file 46, block 3681) found same corrupt data (no logical check)Hex dump of (file 1, block 2017) in trace file /u01/app/oracle/diag/rdbms/his/his/trace/his_pr10_52699.trcCorrupt block relative dba: 0x004007e1 (file 1, block 2017)Bad header found during media recoveryData in bad block: type: 159 format: 2 rdba: 0x52c5b2b0 last change scn: 0x2ed8.e0bc5af9 seq: 0x62 flg: 0xe9 spare1: 0x81 spare2: 0x1e spare3: 0xda98 consistency value in tail: 0xc5753dd3 check value in block header: 0x2bba block checksum disabledReading datafile '/u01/app/oracle/oradata/system01.dbf' for corruption at rdba: 0x004007e1 (file 1, block 2017)Reread (file 1, block 2017) found same corrupt data (no logical check)Media Recovery failed with error 742Errors in file /u01/app/oracle/diag/rdbms/his/his/trace/his_pr00_52622.trc:ORA-00283: recovery session canceled due to errorsORA-00742: Log read detects lost write in thread %d sequence %d block %dORA-00312: online log 7 thread 1: '/u01/app/oracle/oradata/redo07.log'ORA-10877 signalled during: ALTER DATABASE RECOVER database ... |
嘗試強制打開數據庫報ORA-600 krsi_al_hdr_update.15,參考:Oracle斷電故障處理中有類似報錯
SQL> alter database open resetlogs;alter database open resetlogs*ERROR at line 1:ORA-00600: internal error code, arguments: [krsi_al_hdr_update.15],[4294967295], [], [], [], [], [], [], [], [], [], [] |
由於redo問題無法resetlogs成功,解決異常redo,再次嘗試open庫,由於undo壞塊無法open成功
SQL> alter database open resetlogs;alter database open resetlogs*ERROR at line 1:ORA-01092: ORACLE instance terminated. Disconnection forcedORA-01578: ORACLE data block corrupted (file # 3, block # 1848)ORA-01110: data file 3: '/u01/app/oracle/oradata/undotbs01.dbf'Process ID: 55655Session ID: 2623 Serial number: 5 |
解決undo異常,數據庫open成功.導出客戶需要數據,完成此次恢復工作