logminer系列文章一（logminer的使用）

转自 http://blog.itpub.net/26613085/viewspace-1064008/

1、安装logminer以及生成logminer数据字典所需要的包（需使用sys用户） 
[oracle@rac1 ~]$ echo $ORACLE_HOME
/u01/app/oracle/product/10.2.0/db_1

SQL> show user 
USER is "SYS"
SQL> @/u01/app/oracle/product/10.2.0/db_1/rdbms/admin/dbmslm.sql

Package created.

Grant succeeded.

SQL> @/u01/app/oracle/product/10.2.0/db_1/rdbms/admin/dbmslmd.sql

Package created.

2、生成数据字典文件
创建logminer存放的目录
[oracle@rac1 logmine_dir]$ mkdir /u01/logminer_dir

修改oracle的utl_file_dir参数

SQL> alter system set utl_file_dir='/u01/logminer_dir' scope=both;
alter system set utl_file_dir='/u01/logminer_dir' scope=both
                 *
ERROR at line 1:
ORA-02095: specified initialization parameter cannot be modified

SQL> alter system set utl_file_dir='/u01/logminer_dir/' scope=spfile;

System altered.

SQL> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL> startup
ORACLE instance started.

Total System Global Area  285212672 bytes
Fixed Size                  1218992 bytes
Variable Size              67110480 bytes
Database Buffers          213909504 bytes
Redo Buffers                2973696 bytes
Database mounted.
Database opened.
SQL> show parameter utl_file_dir

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
utl_file_dir                         string      /u01/logminer_dir/

SQL> begin
  2  sys.dbms_logmnr_d.build(dictionary_filename =>'logminerdcit.ora',
  3                          dictionary_location =>'/u01/logminer_dir',
  4                                       options=>dbms_logmnr_d.store_in_flat_file);
  5  end;
  6  /
begin
*
ERROR at line 1:
ORA-01336: specified dictionary file cannot be opened
ORA-29280: invalid directory path
ORA-06512: at "SYS.DBMS_LOGMNR_INTERNAL", line 3474
ORA-06512: at "SYS.DBMS_LOGMNR_INTERNAL", line 3552
ORA-06512: at "SYS.DBMS_LOGMNR_D", line 12
ORA-06512: at line 2

SQL> begin
  2  sys.dbms_logmnr_d.build(dictionary_filename =>'logminerdcit.ora',
  3                          dictionary_location =>'/u01/logminer_dir/',
  4                                       options=>dbms_logmnr_d.store_in_flat_file);
  5  end;
  6  /

PL/SQL procedure successfully completed.

看来这个路径后面的斜杠不能省略。
[oracle@rac1 ~]$ cd /u01/logminer_dir/
[oracle@rac1 logminer_dir]$ ll
total 22852
-rw-r--r--  1 oracle oinstall 23368495 Dec 22 17:05 logminerdcit.ora
在指定的目录下面已经可以看到刚才生成的数据字典文件了。
3、下面我们在数据库里面创建一个表，然后插入几条记录，归档日志，然后再把该表drop掉，看看logminer能不能查到相关的信息

SQL> create table dcits_test(id number);

Table created.

SQL> insert into dcits_test values(1);

1 row created.

SQL> insert into dcits_test values(2);

1 row created.

SQL> insert into dcits_test values(3);

1 row created.

SQL> archive log list
Database log mode              Archive Mode
Automatic archival             Enabled
Archive destination            /u01/app/oracle/oradata/dcits/archive/
Oldest online log sequence     4
Next log sequence to archive   6
Current log sequence           6
目前数据库已经是归档模式，并且归档位置在/u01/app/oracle/oradata/dcits/archive/

先查看下该目录
[oracle@rac1 ~]$ cd /u01/app/oracle/oradata/dcits/archive
[oracle@rac1 archive]$ ll
total 0
新修改的归档模式，还没有进行归档操作
下面对当前的在线日志进行归档

SQL> alter system archive log current;

System altered.

再查看下刚才的归档目录，可见已经产生了一个归档日志
[oracle@rac1 archive]$ pwd
/u01/app/oracle/oradata/dcits/archive
[oracle@rac1 archive]$ ll
total 16080
-rw-r-----  1 oracle oinstall 16441856 Dec 22 17:17 1_6_834506858.dbf
下面我们把这个表drop掉

SQL> drop table dcits_test;

Table dropped.
然后我们把刚才归档的日志和当前在线日志都进行分析下，看看能不能查看到这些操作信息
看下当前哪个日志在线
SQL> select * from v$log;
    GROUP#    THREAD#  SEQUENCE#      BYTES    MEMBERS ARC STATUS           FIRST_CHANGE# FIRST_TIM
---------- ---------- ---------- ---------- ---------- --- ---------------- ------------- ---------
         1          1          5   52428800          1 YES INACTIVE                508835 20-DEC-13
         2          1          6   52428800          1 YES INACTIVE                537485 22-DEC-13
         3          1          7   52428800          1 NO  CURRENT                 545026 22-DEC-13
查看日志组3的文件位置

SQL> select * from v$logfile where group#=3;

GROUP# STATUS  TYPE    MEMBER                                             IS_
---------- ------- ------- -------------------------------------------------- ---
         3         ONLINE  /u01/app/oracle/oradata/dcits/redo03.log           NO

SQL> begin
  2    sys.dbms_logmnr.add_logfile(LogFileName => '/u01/app/oracle/oradata/dcits/archive/1_6_834506858.dbf',
  3                                     Options=> dbms_logmnr.new);
  4    sys.dbms_logmnr.add_logfile(LogFileName => '/u01/app/oracle/oradata/dcits/redo03.log',
  5                                     Options=> dbms_logmnr.new);
  6  end;
  7  /

PL/SQL procedure successfully completed.
开始使用LogMiner进行日志分析

SQL> begin
  2    sys.dbms_logmnr.start_logmnr(DictFileName =>'/u01/logminer_dir/logminerdcit.ora');
  3  end;
  4  /

PL/SQL procedure successfully completed.

SQL> select sql_redo from V$LOGMNR_CONTENTS where upper(sql_redo) like '%DCITS_TEST%';

SQL_REDO
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
drop table dcits_test;
delete from "SYS"."OBJ$" where "OBJ#" = '51383' and "DATAOBJ#" = '51383' and "OWNER#" = '0' and "NAME" = 'DCITS_TEST' and "NAMESPACE" = '1' and "SUBNAME" IS NULL and "TYPE#" = '2' and "CTIME" = TO_DAT
E('22-DEC-13', 'DD-MON-RR') and "MTIME" = TO_DATE('22-DEC-13', 'DD-MON-RR') and "STIME" = TO_DATE('22-DEC-13', 'DD-MON-RR') and "STATUS" = '1' and "REMOTEOWNER" IS NULL and "LINKNAME" IS NULL and "FLA
GS" = '0' and "OID$" IS NULL and "SPARE1" = '6' and "SPARE2" = '1' and "SPARE3" IS NULL and "SPARE4" IS NULL and "SPARE5" IS NULL and "SPARE6" IS NULL and ROWID = 'AAAAASAABAAAMRjAAO';
(为什么只看到个drop语句呢？)
结束分析，释放内存

SQL> begin
  2    sys.dbms_logmnr.end_logmnr;
  3  end;
  4  /

PL/SQL procedure successfully completed.

上面的实验并没有显示create table语句，原因参考文档：
--  PROCEDURE INFORMATION:
  --  #1 dbms_logmnr.add_logfile():
  --     DESCRIPTION:
  --       Registers a redo log file with LogMiner. Multiple redo logs can be
  --       registered by calling the procedure repeatedly. The redo logs
  --       do not need to be registered in any particular order.
  --       Both archived and online redo logs can be mined.  If a successful
  --       call to the procedure is made a call to start_logmnr() must be
  --       made before selecting from v$logmnr_contents.
  --
  --     CONSTANTS:
  --       dbms_logmnr.NEW:  Starts a new list. Any file registered prior to
  --         this call is discarded.

--       dbms_logmnr.ADDFILE:  Adds the redo log to the existing
  --         list. LogMiner checks to make sure that the redo log is from
  --         the same database (DB_ID and RESETLOGS_SCN) incarnation as the
  --         ones previously added.

SQL> begin
  2    sys.dbms_logmnr.add_logfile(LogFileName => '/u01/app/oracle/oradata/dcits/archive/1_6_834506858.dbf',
  3                                     Options=> dbms_logmnr.new);
  4    sys.dbms_logmnr.add_logfile(LogFileName => '/u01/app/oracle/oradata/dcits/redo03.log',
  5                                     Options=> dbms_logmnr.new);
  6  end;
  7  /
添加日志文件的时候两个都用到了dbms_logmnr.new，第二条添加在线日志的时候相当于又重新开始一个文件列表，所以'/u01/app/oracle/oradata/dcits/archive/1_6_834506858.dbf'归档日志并没有添加被分析，所以没有看到那个create table dcits_test(id number);
至于为什么没有看到insert语句，等有时间再做下实验，需要alter database add supplemental log data;