lsof 应用实例分享以及Oracle 数据文件删除恢复测试
来源：互联网 发布：阿里云服务器备案时间 编辑：程序博客网 时间：2024/06/01 17:15
㈠ lsof 应用实例
① 查找指定端口被哪个程序占用：
[root@temp ~]# lsof -i :80COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEhttpd 10278 root 3u IPv6 37812 0t0 TCP *:http (LISTEN)httpd 10280 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)httpd 10281 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)httpd 10282 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)httpd 10283 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)httpd 10284 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)httpd 10285 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)httpd 10286 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)httpd 10287 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
② 查找指定文件正在被谁使用：
[root@temp ~]# lsof /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbfCOMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEoracle 11239 oracle 23uW REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbforacle 11241 oracle 29u REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbforacle 11245 oracle 21u REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbforacle 11251 oracle 22u REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbforacle 11260 oracle 19u REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf
③ 查找某个用户打开的文件
[root@temp ~]# lsof -u oracle COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEbash 5601 oracle cwd DIR 8,2 4096 1491645 /home/oraclebash 5601 oracle rtd DIR 8,2 4096 2 /bash 5601 oracle txt REG 8,2 735804 1782911 /bin/bashbash 5601 oracle mem REG 8,2 5436 584246 /usr/lib/gconv/ISO8859-1.sobash 5601 oracle mem REG 8,2 130860 390859 /lib/ld-2.5.sobash 5601 oracle mem REG 8,2 1706072 391064 /lib/i686/nosegneg/libc-2.5.sobash 5601 oracle mem REG 8,2 20668 391065 /lib/libdl-2.5.sobash 5601 oracle mem REG 8,2 13276 391090 /lib/libtermcap.so.2.0.8bash 5601 oracle mem REG 8,2 50848 389032 /lib/libnss_files-2.5.sobash 5601 oracle mem REG 8,2 25462 584323 /usr/lib/gconv/gconv-modules.cachebash 5601 oracle mem REG 8,2 56449792 491499 /usr/lib/locale/locale-archivebash 5601 oracle 0u CHR 136,1 0t0 3 /dev/pts/1.....................................
④ 查找某个程序现在正打开的文件
-c：程序名-p：pid [root@temp ~]# lsof -c initCOMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEinit 1 root cwd DIR 8,2 4096 2 /init 1 root rtd DIR 8,2 4096 2 /init 1 root txt REG 8,2 38652 1620888 /sbin/initinit 1 root mem REG 8,2 130860 390859 /lib/ld-2.5.soinit 1 root mem REG 8,2 1706072 391064 /lib/i686/nosegneg/libc-2.5.soinit 1 root mem REG 8,2 20668 391065 /lib/libdl-2.5.soinit 1 root mem REG 8,2 245376 391081 /lib/libsepol.so.1init 1 root mem REG 8,2 93508 391082 /lib/libselinux.so.1init 1 root 10u FIFO 0,16 0t0 1322 /dev/initctl
⑤ 查找某个用户的所有网络连接
[root@temp ~]# lsof -a -u oracle -iCOMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEsqlplus 5631 oracle 7u IPv4 42558 0t0 UDP localhost.localdomain:52493 oracle 11233 oracle 15u IPv4 42442 0t0 UDP localhost.localdomain:62999 oracle 11255 oracle 14u IPv4 42529 0t0 UDP localhost.localdomain:18473 oracle 11255 oracle 15u IPv4 42530 0t0 TCP *:4048 (LISTEN)oracle 11257 oracle 14u IPv4 42540 0t0 UDP localhost.localdomain:8690 oracle 11260 oracle 22u IPv4 42728 0t0 UDP *:12147
⑥ 查找所有打开的网络连接
类似的：lsof -i tcp lsof -i udp lsof -i tcp:80 [root@temp ~]# lsof -iCOMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEcupsd 3062 root 4u IPv4 8720 0t0 TCP localhost.localdomain:ipp (LISTEN)cupsd 3062 root 6u IPv4 8723 0t0 UDP *:ipp portmap 3600 rpc 3u IPv4 9798 0t0 UDP *:sunrpc portmap 3600 rpc 4u IPv4 9799 0t0 TCP *:sunrpc (LISTEN)rpc.statd 3636 rpcuser 3u IPv4 9992 0t0 UDP *:dhcp-failover2 rpc.statd 3636 rpcuser 6u IPv4 9978 0t0 UDP *:844 rpc.statd 3636 rpcuser 7u IPv4 10005 0t0 TCP *:850 (LISTEN)hpiod 3890 root 0u IPv4 12249 0t0 TCP localhost.localdomain:2208 (LISTEN)hpssd.py 3895 root 4u IPv4 12267 0t0 TCP localhost.localdomain:2207 (LISTEN)sshd 3908 root 3u IPv6 12303 0t0 TCP *:ssh (LISTEN)sshd 3908 root 4u IPv4 12305 0t0 TCP *:ssh (LISTEN)sendmail 3939 root 4u IPv4 12415 0t0 TCP localhost.localdomain:smtp (LISTEN)avahi-dae 4149 avahi 13u IPv4 12875 0t0 UDP *:mdns avahi-dae 4149 avahi 14u IPv6 12876 0t0 UDP *:mdns avahi-dae 4149 avahi 15u IPv4 12877 0t0 UDP *:8990 avahi-dae 4149 avahi 16u IPv6 12878 0t0 UDP *:6857 dnsmasq 4169 nobody 5u IPv4 13032 0t0 UDP *:bootps dnsmasq 4169 nobody 6u IPv4 13038 0t0 TCP 192.168.122.1:domain (LISTEN)dnsmasq 4169 nobody 7u IPv4 13039 0t0 UDP 192.168.122.1:domain cimserver 4172 cimsrvr 7u IPv6 13141 0t0 TCP *:wbem-https (LISTEN)dhclient 4721 root 5u IPv4 13899 0t0 UDP *:bootpc sqlplus 5631 oracle 7u IPv4 42558 0t0 UDP localhost.localdomain:52493 httpd 10278 root 3u IPv6 37812 0t0 TCP *:http (LISTEN)
㈡ 数据文件恢复测试
原理：
后台进程会维护一个文件列表、锁定打开的文件
对Oracle而言、如果文件被删除、但该文件句柄尚未被关闭、则可通过lsof输出看到标识为deleted
通过 proc 的文件目录、能找到该文件句柄信息、这便是Oracle的数据文件
** 测试之前****[oracle@temp datafile]$ ls -alhtotal 1.3Gdrwxr-x--- 2 oracle oinstall 4.0K May 9 20:37 .drwxr-xr-x 5 oracle oinstall 4.0K Jul 17 2012 ..-rw-r----- 1 oracle oinstall 101M Jun 19 14:19 o1_mf_example_8050jhm7_.dbf-rw-r----- 1 oracle oinstall 81M Jun 19 14:19 o1_mf_ggs_data_8rq64t53_.dbf-rw-r----- 1 oracle oinstall 271M Jun 19 19:00 o1_mf_sysaux_8050fk3w_.dbf-rw-r----- 1 oracle oinstall 491M Jun 19 18:56 o1_mf_system_8050fk2z_.dbf-rw-r----- 1 oracle oinstall 33M Jun 17 22:00 o1_mf_temp_8050j34j_.tmp-rw-r----- 1 oracle oinstall 236M Jun 19 18:59 o1_mf_undotbs1_8050fkc6_.dbf-rw-r----- 1 oracle oinstall 47M Jun 19 17:12 o1_mf_users_8050fkdh_.dbf** 看看 dbwr 打开的所有文件 **[root@temp ~]# ps -ef | grep dbworacle 5643 1 0 14:19 ? 00:00:00 ora_dbw0_orclroot 10741 8274 0 19:00 pts/3 00:00:00 grep dbw** 运用lsof 列出所有被 dbwr 打开的文件 **[root@temp ~]# lsof -p 5643COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEoracle 5643 oracle cwd DIR 8,2 4096 1556206 /u01/app/oracle/product/10.2.0/db_1/dbsoracle 5643 oracle rtd DIR 8,2 4096 2 /oracle 5643 oracle txt REG 8,2 93362427 1557452 /u01/app/oracle/product/10.2.0/db_1/bin/oracleoracle 5643 oracle mem REG 8,2 70077 1565448 /u01/app/oracle/product/10.2.0/db_1/lib/libclsra10.sooracle 5643 oracle mem REG 8,2 50848 389032 /lib/libnss_files-2.5.sooracle 5643 oracle mem REG 8,2 1544 1555978 /u01/app/oracle/product/10.2.0/db_1/dbs/hc_orcl.datoracle 5643 oracle mem REG 8,2 20668 391065 /lib/libdl-2.5.sooracle 5643 oracle mem REG 8,2 216560 391071 /lib/i686/nosegneg/libm-2.5.sooracle 5643 oracle mem REG 8,2 1211519 1565413 /u01/app/oracle/product/10.2.0/db_1/lib/libocrb10.sooracle 5643 oracle mem REG 8,2 130860 390859 /lib/ld-2.5.sooracle 5643 oracle mem REG 8,2 2632 497850 /usr/lib/libaio.so.1.0.1oracle 5643 oracle mem REG 8,2 728411 1565414 /u01/app/oracle/product/10.2.0/db_1/lib/libocrutl10.sooracle 5643 oracle mem REG 8,2 137960 391066 /lib/i686/nosegneg/libpthread-2.5.sooracle 5643 oracle mem REG 8,2 1706072 391064 /lib/i686/nosegneg/libc-2.5.sooracle 5643 oracle mem REG 8,2 143485 1006037 /u01/app/oracle/product/10.2.0/db_1/lib/libskgxp10.sooracle 5643 oracle mem REG 8,2 109740 391078 /lib/libnsl-2.5.sooracle 5643 oracle mem REG 8,2 854560 1565412 /u01/app/oracle/product/10.2.0/db_1/lib/libocr10.sooracle 5643 oracle mem REG 8,2 98079 1560689 /u01/app/oracle/product/10.2.0/db_1/lib/libdbcfg10.sooracle 5643 oracle mem REG 8,2 2365801 1565447 /u01/app/oracle/product/10.2.0/db_1/lib/libhasgen10.sooracle 5643 oracle mem REG 8,2 8069 1560800 /u01/app/oracle/product/10.2.0/db_1/lib/libskgxn2.sooracle 5643 oracle mem REG 8,2 5480533 1565995 /u01/app/oracle/product/10.2.0/db_1/lib/libnnz10.sooracle 5643 oracle mem REG 8,2 9017903 1558479 /u01/app/oracle/product/10.2.0/db_1/lib/libjox10.sooracle 5643 oracle DEL REG 0,9 5603346 /SYSVbe3bb918oracle 5643 oracle mem CHR 1,5 1559 /dev/zerooracle 5643 oracle 0r CHR 1,3 0t0 1557 /dev/nulloracle 5643 oracle 1r CHR 1,3 0t0 1557 /dev/nulloracle 5643 oracle 2r CHR 1,3 0t0 1557 /dev/nulloracle 5643 oracle 3r CHR 1,3 0t0 1557 /dev/nulloracle 5643 oracle 4r CHR 1,3 0t0 1557 /dev/nulloracle 5643 oracle 5w REG 8,2 624 1206137 /u01/app/oracle/admin/orcl/udump/orcl_ora_5634.trcoracle 5643 oracle 6w REG 8,2 232742 324300 /u01/app/oracle/admin/orcl/bdump/alert_orcl.logoracle 5643 oracle 7u REG 8,2 0 1169911 /u01/app/oracle/product/10.2.0/db_1/dbs/lkinstorcl (deleted)oracle 5643 oracle 8w REG 8,2 232742 324300 /u01/app/oracle/admin/orcl/bdump/alert_orcl.logoracle 5643 oracle 9u REG 8,2 1544 1555978 /u01/app/oracle/product/10.2.0/db_1/dbs/hc_orcl.datoracle 5643 oracle 10u REG 8,2 1298 230930 /u01/app/oracle/admin/orcl/adump/ora_5634.audoracle 5643 oracle 11r CHR 1,5 0t0 1559 /dev/zerooracle 5643 oracle 12r CHR 1,5 0t0 1559 /dev/zerooracle 5643 oracle 13r REG 8,2 834560 1565481 /u01/app/oracle/product/10.2.0/db_1/rdbms/mesg/oraus.msboracle 5643 oracle 14u REG 8,2 1544 1555978 /u01/app/oracle/product/10.2.0/db_1/dbs/hc_orcl.datoracle 5643 oracle 15uR REG 8,2 24 1555979 /u01/app/oracle/product/10.2.0/db_1/dbs/lkORCLoracle 5643 oracle 16u REG 8,2 7094272 1977496 /u01/app/oracle/oradata/ORCL/controlfile/o1_mf_823mrrdo_.ctloracle 5643 oracle 17u REG 8,2 7094272 1851190 /u01/app/oracle/flash_recovery_area/ORCL/controlfile/o1_mf_823mrrrp_.ctloracle 5643 oracle 18uW REG 8,2 513810432 1977493 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_system_8050fk2z_.dbforacle 5643 oracle 19uW REG 8,2 246423552 1977494 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_undotbs1_8050fkc6_.dbforacle 5643 oracle 20uW REG 8,2 283123712 1977489 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_sysaux_8050fk3w_.dbforacle 5643 oracle 21uW REG 8,2 48504832 1977490 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_users_8050fkdh_.dbforacle 5643 oracle 22uW REG 8,2 104865792 1977491 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_example_8050jhm7_.dbforacle 5643 oracle 23uW REG 8,2 83894272 1977501 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf (deleted)oracle 5643 oracle 24uW REG 8,2 33562624 1977492 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_temp_8050j34j_.tmporacle 5643 oracle 25r REG 8,2 834560 1565481 /u01/app/oracle/product/10.2.0/db_1/rdbms/mesg/oraus.msb** 把 o1_mf_ggs_data_8rq64t53_.dbf 删除 **[oracle@temp datafile]$ rm -rf o1_mf_ggs_data_8rq64t53_.dbf** 列出23 号文件句柄的信息 ***[root@temp ~]# ls -alh /proc/5643/fd/23lrwx------ 1 oracle oinstall 64 06-19 18:08 /proc/5643/fd/23 -> /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf (deleted)** 直接复制过去就行了 **[root@temp ~]# cp /proc/5643/fd/23 /u01/app/oracle/oradata/ORCL/datafile/[root@temp ~]# chown -R oracle:oinstall /u01/app/oracle/oradata/ORCL/datafile/23*** 重命名 *****[oracle@temp datafile]$ ls -ltotal 1283716-rw-r----- 1 oracle oinstall 83894272 Jun 19 19:11 23-rw-r----- 1 oracle oinstall 104865792 Jun 19 14:19 o1_mf_example_8050jhm7_.dbf-rw-r----- 1 oracle oinstall 283123712 Jun 19 19:12 o1_mf_sysaux_8050fk3w_.dbf-rw-r----- 1 oracle oinstall 513810432 Jun 19 19:12 o1_mf_system_8050fk2z_.dbf-rw-r----- 1 oracle oinstall 33562624 Jun 17 22:00 o1_mf_temp_8050j34j_.tmp-rw-r----- 1 oracle oinstall 246423552 Jun 19 19:12 o1_mf_undotbs1_8050fkc6_.dbf-rw-r----- 1 oracle oinstall 48504832 Jun 19 17:12 o1_mf_users_8050fkdh_.dbf[oracle@temp datafile]$ mv 23 o1_mf_ggs_data_8rq64t53_.dbf[oracle@temp datafile]$ ls -alhtotal 1.3Gdrwxr-x--- 2 oracle oinstall 4.0K Jun 19 19:14 .drwxr-xr-x 5 oracle oinstall 4.0K Jul 17 2012 ..-rw-r----- 1 oracle oinstall 101M Jun 19 14:19 o1_mf_example_8050jhm7_.dbf-rw-r----- 1 oracle oinstall 81M Jun 19 19:11 o1_mf_ggs_data_8rq64t53_.dbf-rw-r----- 1 oracle oinstall 271M Jun 19 19:13 o1_mf_sysaux_8050fk3w_.dbf-rw-r----- 1 oracle oinstall 491M Jun 19 19:13 o1_mf_system_8050fk2z_.dbf-rw-r----- 1 oracle oinstall 33M Jun 17 22:00 o1_mf_temp_8050j34j_.tmp-rw-r----- 1 oracle oinstall 236M Jun 19 19:13 o1_mf_undotbs1_8050fkc6_.dbf-rw-r----- 1 oracle oinstall 47M Jun 19 17:12 o1_mf_users_8050fkdh_.dbf** 查看状态 **sys@ORCL> shutdown immediateDatabase closed.Database dismounted.ORACLE instance shut down.sys@ORCL> startupORACLE instance started.Total System Global Area 419430400 bytesFixed Size 1219760 bytesVariable Size 104858448 bytesDatabase Buffers 310378496 bytesRedo Buffers 2973696 bytesDatabase mounted.ORA-01113: file 6 needs media recoveryORA-01110: data file 6: '/u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf'sys@ORCL> recover datafile 6;Media recovery complete.sys@ORCL> alter database open;Database altered.sys@ORCL> select file_name,status from dba_data_files where FILE_ID=6;FILE_NAME STATUS-------------------------------------------------------------------- ---------/u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf AVAILABLE
By David Lin
2013-06-19
Always be a first-rate version of yourself,instead of a second-rate version of someone else.
- lsof 应用实例分享以及Oracle 数据文件删除恢复测试
- lsof 应用实例分享以及Oracle 数据文件删除恢复测试
- Oracle 意外删除数据文件的恢复
- ORACLE 删除数据文件模拟灾难恢复
- oracle数据文件被删除没备份恢复
- Oracle意外删除数据文件恢复方法
- oracle数据文件被删除的恢复
- linux 误删除Oracle数据文件恢复
- 继续lsof删除恢复
- lsof恢复删除的文件
- oracle误用操作系统命令删除数据文件的恢复方法
- Linux下ORACLE误删除数据文件恢复操作
- oracle数据文件被误操作删除了恢复方法
- Oracle数据库数据文件rm -rf误删除后恢复
- 【转载】linux中误删除oracle数据文件的恢复操作
- 使用linux文件句柄恢复误删除的Oracle数据文件
- Linux中模拟oracle数据文件的误删除与恢复
- Oracle数据库数据文件rm -rf误删除后恢复
- Blink, 通向哈里·波特的魔法世界
- 数据结构_图_prim最小生成树算法
- [C++STDlib基础]关于字符串的操作——C++标准库头文件<cstring>
- hdu 2108 Shape of HDU（判断多边形是否为凸多边形）
- 用复数value一次给数据库插入多条记录
- lsof 应用实例分享以及Oracle 数据文件删除恢复测试
- 详细的Linux shell脚本基础学习
- Paypal收款扣手续费计算方法，终于遇到了次
- 小结牛腩新闻发布系统遇到的问题
- 【月入41万】Mono For Android中使用百度地图SDK
- 图像灰度化原理和实现
- Redis anet
- JavaFX 的 Button 控件
- 翻转单词顺序
