oracle 11g 使用logminer分析redo和归档日志

一、设置日期格式（方便查看）

SQL> alter system set nls_date_format='yyyy-mm-dd hh24:mi:ss' scope=spfile;

System altered.

SQL>

SQL> select to_char(sysdate,'yyyy-mm-dd hh24:mi:ss') from dual ;

TO_CHAR(SYSDATE,'YY
-------------------
2018-09-19 08:33:27

SQL>

二、开启补全日志

查看补全日志是否开启：

SQL> Select
SUPPLEMENTAL_LOG_DATA_MIN,
SUPPLEMENTAL_LOG_DATA_PK,
SUPPLEMENTAL_LOG_DATA_UI,
SUPPLEMENTAL_LOG_DATA_FK,
SUPPLEMENTAL_LOG_DATA_ALL from v$database;

开启补全日志：

SQL> alter database add supplemental log data;

SQL> alter database add supplemental log data (primary key, unique,foreign key) columns;

再次查看：

SQL> Select
SUPPLEMENTAL_LOG_DATA_MIN,
SUPPLEMENTAL_LOG_DATA_PK,
SUPPLEMENTAL_LOG_DATA_UI,
SUPPLEMENTAL_LOG_DATA_FK,
SUPPLEMENTAL_LOG_DATA_ALL from v$database;

SUPPLEME SUP SUP SUP SUP
-------- --- --- --- ---
YES     YES YES YES NO

SQL> 

三、开启归档

SQL> archive log list
Database log mode           No Archive Mode
Automatic archival           Disabled
Archive destination           USE_DB_RECOVERY_FILE_DEST
Oldest online log sequence     6
Current log sequence           8
SQL> 
SQL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL>        
SQL> 
SQL> startup mount
ORACLE instance started.

Total System Global Area  839282688 bytes
Fixed Size            2217992 bytes
Variable Size          494929912 bytes
Database Buffers      335544320 bytes
Redo Buffers            6590464 bytes
Database mounted.
SQL> 
SQL> 
SQL> alter database archivelog;

Database altered.

SQL>  
SQL> 
SQL> alter database open;

Database altered.

SQL> 
SQL> archive log list
Database log mode           Archive Mode
Automatic archival           Enabled
Archive destination           USE_DB_RECOVERY_FILE_DEST
Oldest online log sequence     6
Next log sequence to archive   8
Current log sequence           8
SQL> 
SQL>

SQL> alter system switch logfile;

System altered.

SQL>

四、配置LogMiner工具

SQL> show parameter UTL_FILE

NAME                     TYPE     VALUE
------------------------------------ ----------- ------------------------------
utl_file_dir                 string
SQL> 
SQL> alter system set utl_file_dir='/u03' scope=spfile;

System altered.

SQL> 
SQL> 
SQL> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> 
SQL> 
SQL> startup
ORACLE instance started.

Total System Global Area  839282688 bytes
Fixed Size            2217992 bytes
Variable Size          494929912 bytes
Database Buffers      335544320 bytes
Redo Buffers            6590464 bytes
Database mounted.
Database opened.
SQL> 
SQL>
SQL> show parameter UTL_FILE

NAME                     TYPE     VALUE
------------------------------------ ----------- ------------------------------
utl_file_dir                 string     /u03
SQL>

五、创建数据字典文件

数据字典文件是一个文本文件，使用包DBMS_LOGMNR_D来创建。如果我们要分析的数据库中的表有变化，影响到库的数据字典也发生变化，这时就需要重新创建该字典文件。另外一种情况是在分析另外一个数据库文件的重作日志时，也必须要重新生成一遍被分析数据库的数据字典文件。

SQL> begin
         dbms_logmnr_d.build('dfdict.data','/u03');   
         end;
         /  

PL/SQL procedure successfully completed.

SQL>

进入操作系统目录，在/u03下已经生成了数据字典文件：dfdict.data

[root@redhat5 u03]# ls
dfdict.data

六、创建要分析的日志文件列表

Oracle的重作日志分为两种，在线（online）和离线（offline）归档日志文件，我这里主要分析归档日志，在线日志原理一样。

6.1、查看日志组的状况

SQL> select GROUP# ,SEQUENCE# ,STATUS  from v$log;

    GROUP#  SEQUENCE# STATUS
---------- ---------- ----------------
     1       10 INACTIVE
     2       11 CURRENT
     3        9 INACTIVE

SQL>

现在做任何操作都是的事物日志记录到第二个日志组的日志文件（current）

6.2、查看日志组成员

SQL> set linesize 120
SQL> col MEMBER format a45
SQL> select GROUP#,MEMBER from v$logfile;

    GROUP# MEMBER
---------- ---------------------------------------------
     3 /u01/app/oracle/oradata/or11g/redo03.log
     2 /u01/app/oracle/oradata/or11g/redo02.log
     1 /u01/app/oracle/oradata/or11g/redo01.log

SQL> 

6.3、模拟误操作：

SQL> alter user scott account unlock identified by oracle;

User altered.

SQL> Update scott.emp set sal=0;

14 rows updated.

SQL> commit;

Commit complete.

SQL>

此时scott.emp表的工资都为0了，发现搞错了，需要恢复。

6.4、创建要挖掘的日志列表：

因为这里只有一个日志，那么只需要添加一个就好了(第一个日志用new“=>dbms_logmnr.new”)

execute dbms_logmnr.add_logfile(options =>dbms_logmnr.new,logfilename =>'/u01/app/oracle/oradata/or11g/redo01.log');

如果是有多个日志，那么就继续添加(添加其他日志用add“=>dbms_logmnr.addfile”)：

execute dbms_logmnr.add_logfile(options =>dbms_logmnr.addfile,logfilename=>'/u01/app/oracle/oradata/or11g/redo02.log');

execute dbms_logmnr.add_logfile(options =>dbms_logmnr.addfile,logfilename=>'/u01/app/oracle/oradata/or11g/redo03.log');

如：

SQL> execute dbms_logmnr.add_logfile(options =>dbms_logmnr.new,logfilename =>'/u01/app/oracle/oradata/or11g/redo01.log');

PL/SQL procedure successfully completed.

SQL> execute dbms_logmnr.add_logfile(options =>dbms_logmnr.addfile,logfilename=>'/u01/app/oracle/oradata/or11g/redo02.log');

PL/SQL procedure successfully completed.

SQL> execute dbms_logmnr.add_logfile(options =>dbms_logmnr.addfile,logfilename=>'/u01/app/oracle/oradata/or11g/redo03.log');

PL/SQL procedure successfully completed.

SQL>

说明：

dbms_logmnr.new --用于建一个日志分析表

dbms_logmnr.addfile --用于加，入用于分析的日志文件

dbms_logmnr.removefile --用于移出，用于分析的日志文件

如果是删除日志就用removefile，如：

execute dbms_logmnr.add_logfile(options =>dbms_logmnr.removefile,logfilename =>'/u01/app/oracle/oradata/or11g/redo03.log');

6.5、开始挖掘：

exec dbms_logmnr.start_logmnr(dictfilename=>'/u03/dfdict.data');

如：

SQL> exec dbms_logmnr.start_logmnr(dictfilename=>'/u03/dfdict.data');

PL/SQL procedure successfully completed.

SQL>

6.6、查看结果（这个是查询到当初误操作的语句，是通过redo查出来的）：

select sql_redo from v$logmnr_contents where seg_name='EMP';

如：

SQL> select sql_redo from v$logmnr_contents where seg_name='EMP';

SQL_REDO
------------------------------------------------------------------------------------------------------------------------
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7369' and "SAL" = '800' and ROWID = 'AAAR3xAAEAAAACXAAA';
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7499' and "SAL" = '1600' and ROWID = 'AAAR3xAAEAAAACXAAB';
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7521' and "SAL" = '1250' and ROWID = 'AAAR3xAAEAAAACXAAC';
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7566' and "SAL" = '2975' and ROWID = 'AAAR3xAAEAAAACXAAD';
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7654' and "SAL" = '1250' and ROWID = 'AAAR3xAAEAAAACXAAE';
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7698' and "SAL" = '2850' and ROWID = 'AAAR3xAAEAAAACXAAF';
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7782' and "SAL" = '2450' and ROWID = 'AAAR3xAAEAAAACXAAG';
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7788' and "SAL" = '3000' and ROWID = 'AAAR3xAAEAAAACXAAH';
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7839' and "SAL" = '5000' and ROWID = 'AAAR3xAAEAAAACXAAI';
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7844' and "SAL" = '1500' and ROWID = 'AAAR3xAAEAAAACXAAJ';
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7876' and "SAL" = '1100' and ROWID = 'AAAR3xAAEAAAACXAAK';

SQL_REDO
------------------------------------------------------------------------------------------------------------------------
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7900' and "SAL" = '950' and ROWID = 'AAAR3xAAEAAAACXAAL';
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7902' and "SAL" = '3000' and ROWID = 'AAAR3xAAEAAAACXAAM';
update "SCOTT"."EMP" set "SAL" = '0' where "EMPNO" = '7934' and "SAL" = '1300' and ROWID = 'AAAR3xAAEAAAACXAAN';

14 rows selected.

SQL>

6.7、现在我需要将数据还原回去，那么就需要执行误操作的相反的操作。（通过undo来查出对应的反向语句）

select sql_undo from v$logmnr_contents where seg_name='EMP';

如：

SQL> select sql_undo from v$logmnr_contents where seg_name='EMP';

SQL_UNDO
------------------------------------------------------------------------------------------------------------------------
update "SCOTT"."EMP" set "SAL" = '800' where "EMPNO" = '7369' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAA';
update "SCOTT"."EMP" set "SAL" = '1600' where "EMPNO" = '7499' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAB';
update "SCOTT"."EMP" set "SAL" = '1250' where "EMPNO" = '7521' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAC';
update "SCOTT"."EMP" set "SAL" = '2975' where "EMPNO" = '7566' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAD';
update "SCOTT"."EMP" set "SAL" = '1250' where "EMPNO" = '7654' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAE';
update "SCOTT"."EMP" set "SAL" = '2850' where "EMPNO" = '7698' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAF';
update "SCOTT"."EMP" set "SAL" = '2450' where "EMPNO" = '7782' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAG';
update "SCOTT"."EMP" set "SAL" = '3000' where "EMPNO" = '7788' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAH';
update "SCOTT"."EMP" set "SAL" = '5000' where "EMPNO" = '7839' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAI';
update "SCOTT"."EMP" set "SAL" = '1500' where "EMPNO" = '7844' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAJ';
update "SCOTT"."EMP" set "SAL" = '1100' where "EMPNO" = '7876' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAK';

SQL_UNDO
------------------------------------------------------------------------------------------------------------------------
update "SCOTT"."EMP" set "SAL" = '950' where "EMPNO" = '7900' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAL';
update "SCOTT"."EMP" set "SAL" = '3000' where "EMPNO" = '7902' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAM';
update "SCOTT"."EMP" set "SAL" = '1300' where "EMPNO" = '7934' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAN';

14 rows selected.

SQL>

6.8、获取到反向操作语句后，再将反向操作语句重新执行一遍

update "SCOTT"."EMP" set "SAL" = '800' where "EMPNO" = '7369' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAA';
update "SCOTT"."EMP" set "SAL" = '1600' where "EMPNO" = '7499' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAB';
update "SCOTT"."EMP" set "SAL" = '1250' where "EMPNO" = '7521' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAC';
update "SCOTT"."EMP" set "SAL" = '2975' where "EMPNO" = '7566' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAD';
update "SCOTT"."EMP" set "SAL" = '1250' where "EMPNO" = '7654' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAE';
update "SCOTT"."EMP" set "SAL" = '2850' where "EMPNO" = '7698' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAF';
update "SCOTT"."EMP" set "SAL" = '2450' where "EMPNO" = '7782' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAG';
update "SCOTT"."EMP" set "SAL" = '3000' where "EMPNO" = '7788' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAH';
update "SCOTT"."EMP" set "SAL" = '5000' where "EMPNO" = '7839' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAI';
update "SCOTT"."EMP" set "SAL" = '1500' where "EMPNO" = '7844' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAJ';
update "SCOTT"."EMP" set "SAL" = '1100' where "EMPNO" = '7876' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAK';
update "SCOTT"."EMP" set "SAL" = '950' where "EMPNO" = '7900' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAL';
update "SCOTT"."EMP" set "SAL" = '3000' where "EMPNO" = '7902' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAM';
update "SCOTT"."EMP" set "SAL" = '1300' where "EMPNO" = '7934' and "SAL" = '0' and ROWID = 'AAAR3xAAEAAAACXAAN';

6.9、查询最后结果显示，数据全部找回

SQL> select sal from scott.emp;

       SAL
----------
       800
      1600
      1250
      2975
     0
     0
      2450
      3000
      5000
      1500
      1100

       SAL
----------
       950
      3000
      1300

14 rows selected.

SQL>

七、结束logminer

exec dbms_logmnr.end_logmnr();

如：

SQL> exec dbms_logmnr.end_logmnr();

PL/SQL procedure successfully completed.

SQL>

***************************************************************************************************************************
***************************************************************************************************************************

八、使用logminer分析归档日志

8.1、数据库运行在归档模式

8.2、数据库已开启补全日志（附加日志）

8.3、查看字典文件生成目录

SQL> show parameter utl_file_dir 

NAME                     TYPE     VALUE
------------------------------------ ----------- ------------------------------
utl_file_dir                 string     /u03
SQL>

8.4、为了方便实验，授予Scott用户dba权限

SQL> grant dba to scott;

Grant succeeded.

SQL> 
SQL> conn scott/oracle
Connected.
SQL> 

8.5、查看数据库当前日志文件及归档信息

SQL> set linesize 120
SQL> 
SQL> select GROUP#,THREAD#,SEQUENCE#,ARCHIVED,MEMBERS,status from v$log;

    GROUP#    THREAD#  SEQUENCE# ARC    MEMBERS STATUS
---------- ---------- ---------- --- ---------- ----------------
     1        1         154 YES          1 INACTIVE
     2        1         153 YES          1 INACTIVE
     3        1         155 NO          1 CURRENT

SQL> 

8.6、创建数据字典文件目录

SQL> begin
         dbms_logmnr_d.build('007dict.data','/u03');
         end;
         /  2    3    4  

PL/SQL procedure successfully completed.

SQL>

8.7、创建实验表

SQL> create table xxx as select * from emp;

Table created.

SQL> select * from xxx;

     EMPNO ENAME      JOB           MGR HIREDATE              SAL    COMM     DEPTNO
---------- ---------- --------- ---------- ------------------- ---------- ---------- ----------
      7369 SMITH      CLERK          7902 1980-12-17 00:00:00        0             20
      7499 ALLEN      SALESMAN          7698 1981-02-20 00:00:00        0     300         30
      7521 WARD       SALESMAN          7698 1981-02-22 00:00:00        0     500         30
      7566 JONES      MANAGER          7839 1981-04-02 00:00:00        0             20
      7654 MARTIN     SALESMAN          7698 1981-09-28 00:00:00        0    1400         30
      7698 BLAKE      MANAGER          7839 1981-05-01 00:00:00        0             30
      7782 CLARK      MANAGER          7839 1981-06-09 00:00:00        0             10
      7788 SCOTT      ANALYST          7566 1987-04-19 00:00:00        0             20
      7839 KING       PRESIDENT        1981-11-17 00:00:00        0             10
      7844 TURNER     SALESMAN          7698 1981-09-08 00:00:00        0       0         30
      7876 ADAMS      CLERK          7788 1987-05-23 00:00:00        0             20

     EMPNO ENAME      JOB           MGR HIREDATE              SAL    COMM     DEPTNO
---------- ---------- --------- ---------- ------------------- ---------- ---------- ----------
      7900 JAMES      CLERK          7698 1981-12-03 00:00:00        0             30
      7902 FORD       ANALYST          7566 1981-12-03 00:00:00        0             20
      7934 MILLER     CLERK          7782 1982-01-23 00:00:00        0             10

14 rows selected.

SQL> 
SQL> 
SQL> update xxx set job=sal;

14 rows updated.

SQL> commit;

Commit complete.

SQL> alter system switch logfile;

System altered.

SQL>

8.8、查看数据库当前归档信息

SQL> select GROUP#,THREAD#,SEQUENCE#,ARCHIVED,MEMBERS,status from v$log;

    GROUP#    THREAD#  SEQUENCE# ARC    MEMBERS STATUS
---------- ---------- ---------- --- ---------- ----------------
     1        1         154 YES          1 INACTIVE
     2        1         156 NO          1 CURRENT
     3        1         155 YES          1 ACTIVE

SQL> alter system switch logfile;

System altered.

SQL> select GROUP#,THREAD#,SEQUENCE#,ARCHIVED,MEMBERS,status from v$log;

    GROUP#    THREAD#  SEQUENCE# ARC    MEMBERS STATUS
---------- ---------- ---------- --- ---------- ----------------
     1        1         157 NO          1 CURRENT
     2        1         156 YES          1 ACTIVE
     3        1         155 YES          1 ACTIVE

SQL>

8.9、添加要分析的归档文件

SQL> execute dbms_logmnr.add_logfile('/u01/app/oracle/flash_recovery_area/OR11G/archivelog/2018_09_20/o1_mf_1_153_ft6k0418_.arc',DBMS_LOGMNR.new );

PL/SQL procedure successfully completed.

SQL> execute dbms_logmnr.add_logfile('/u01/app/oracle/flash_recovery_area/OR11G/archivelog/2018_09_20/o1_mf_1_154_ft6k04lg_.arc',DBMS_LOGMNR.addfile );

PL/SQL procedure successfully completed.

SQL> execute dbms_logmnr.add_logfile('/u01/app/oracle/flash_recovery_area/OR11G/archivelog/2018_09_20/o1_mf_1_155_ft6mvo0s_.arc',DBMS_LOGMNR.addfile );

PL/SQL procedure successfully completed.

SQL> execute dbms_logmnr.add_logfile('/u01/app/oracle/flash_recovery_area/OR11G/archivelog/2018_09_20/o1_mf_1_156_ft6mwq0j_.arc',DBMS_LOGMNR.addfile );

PL/SQL procedure successfully completed.

SQL> execute dbms_logmnr.add_logfile('/u01/app/oracle/flash_recovery_area/OR11G/archivelog/2018_09_20/o1_mf_1_158_ft6n833c_.arc',DBMS_LOGMNR.addfile );

PL/SQL procedure successfully completed.

SQL> execute dbms_logmnr.add_logfile('/u01/app/oracle/flash_recovery_area/OR11G/archivelog/2018_09_20/o1_mf_1_157_ft6n80o4_.arc',DBMS_LOGMNR.addfile );

PL/SQL procedure successfully completed.

SQL> 

8.10、执行分析

SQL> exec dbms_logmnr.start_logmnr(dictfilename=>'/u03/007dict.data');

PL/SQL procedure successfully completed.

SQL>

8.11、将分析结果持久化保存

因为logminer分析处理的结果只有本session能看到，所以可以先用表把数据记录，然后再进行分析：

SQL> Create table df01 as select * from v$logmnr_contents;

Table created.

SQL> 
8.12、分析数据表