lsof 应用实例分享以及Oracle 数据文件删除恢复测试
来源：互联网 发布：高性能mysql 第3版 编辑：程序博客网 时间：2024/06/06 04:41
㈠ lsof 应用实例
① 查找指定端口被哪个程序占用：
[plain] view plaincopyprint?
[root@temp ~]# lsof -i :80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 10278 root 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10280 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10281 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10282 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10283 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10284 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10285 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10286 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10287 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
② 查找指定文件正在被谁使用：
[plain] view plaincopyprint?
[root@temp ~]# lsof /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
oracle 11239 oracle 23uW REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf
oracle 11241 oracle 29u REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf
oracle 11245 oracle 21u REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf
oracle 11251 oracle 22u REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf
oracle 11260 oracle 19u REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf
③ 查找某个用户打开的文件
[plain] view plaincopyprint?
[root@temp ~]# lsof -u oracle
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
bash 5601 oracle cwd DIR 8,2 4096 1491645 /home/oracle
bash 5601 oracle rtd DIR 8,2 4096 2 /
bash 5601 oracle txt REG 8,2 735804 1782911 /bin/bash
bash 5601 oracle mem REG 8,2 5436 584246 /usr/lib/gconv/ISO8859-1.so
bash 5601 oracle mem REG 8,2 130860 390859 /lib/ld-2.5.so
bash 5601 oracle mem REG 8,2 1706072 391064 /lib/i686/nosegneg/libc-2.5.so
bash 5601 oracle mem REG 8,2 20668 391065 /lib/libdl-2.5.so
bash 5601 oracle mem REG 8,2 13276 391090 /lib/libtermcap.so.2.0.8
bash 5601 oracle mem REG 8,2 50848 389032 /lib/libnss_files-2.5.so
bash 5601 oracle mem REG 8,2 25462 584323 /usr/lib/gconv/gconv-modules.cache
bash 5601 oracle mem REG 8,2 56449792 491499 /usr/lib/locale/locale-archive
bash 5601 oracle 0u CHR 136,1 0t0 3 /dev/pts/1
.....................
................
④ 查找某个程序现在正打开的文件
[plain] view plaincopyprint?
-c：程序名
-p：pid
[root@temp ~]# lsof -c init
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
init 1 root cwd DIR 8,2 4096 2 /
init 1 root rtd DIR 8,2 4096 2 /
init 1 root txt REG 8,2 38652 1620888 /sbin/init
init 1 root mem REG 8,2 130860 390859 /lib/ld-2.5.so
init 1 root mem REG 8,2 1706072 391064 /lib/i686/nosegneg/libc-2.5.so
init 1 root mem REG 8,2 20668 391065 /lib/libdl-2.5.so
init 1 root mem REG 8,2 245376 391081 /lib/libsepol.so.1
init 1 root mem REG 8,2 93508 391082 /lib/libselinux.so.1
init 1 root 10u FIFO 0,16 0t0 1322 /dev/initctl
⑤ 查找某个用户的所有网络连接
[plain] view plaincopyprint?
[root@temp ~]# lsof -a -u oracle -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sqlplus 5631 oracle 7u IPv4 42558 0t0 UDP localhost.localdomain:52493
oracle 11233 oracle 15u IPv4 42442 0t0 UDP localhost.localdomain:62999
oracle 11255 oracle 14u IPv4 42529 0t0 UDP localhost.localdomain:18473
oracle 11255 oracle 15u IPv4 42530 0t0 TCP *:4048 (LISTEN)
oracle 11257 oracle 14u IPv4 42540 0t0 UDP localhost.localdomain:8690
oracle 11260 oracle 22u IPv4 42728 0t0 UDP *:12147
⑥ 查找所有打开的网络连接
[plain] view plaincopyprint?
类似的：
lsof -i tcp
lsof -i udp
lsof -i tcp:80
[root@temp ~]# lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
cupsd 3062 root 4u IPv4 8720 0t0 TCP localhost.localdomain:ipp (LISTEN)
cupsd 3062 root 6u IPv4 8723 0t0 UDP *:ipp
portmap 3600 rpc 3u IPv4 9798 0t0 UDP *:sunrpc
portmap 3600 rpc 4u IPv4 9799 0t0 TCP *:sunrpc (LISTEN)
rpc.statd 3636 rpcuser 3u IPv4 9992 0t0 UDP *:dhcp-failover2
rpc.statd 3636 rpcuser 6u IPv4 9978 0t0 UDP *:844
rpc.statd 3636 rpcuser 7u IPv4 10005 0t0 TCP *:850 (LISTEN)
hpiod 3890 root 0u IPv4 12249 0t0 TCP localhost.localdomain:2208 (LISTEN)
hpssd.py 3895 root 4u IPv4 12267 0t0 TCP localhost.localdomain:2207 (LISTEN)
sshd 3908 root 3u IPv6 12303 0t0 TCP *:ssh (LISTEN)
sshd 3908 root 4u IPv4 12305 0t0 TCP *:ssh (LISTEN)
sendmail 3939 root 4u IPv4 12415 0t0 TCP localhost.localdomain:smtp (LISTEN)
avahi-dae 4149 avahi 13u IPv4 12875 0t0 UDP *:mdns
avahi-dae 4149 avahi 14u IPv6 12876 0t0 UDP *:mdns
avahi-dae 4149 avahi 15u IPv4 12877 0t0 UDP *:8990
avahi-dae 4149 avahi 16u IPv6 12878 0t0 UDP *:6857
dnsmasq 4169 nobody 5u IPv4 13032 0t0 UDP *:bootps
dnsmasq 4169 nobody 6u IPv4 13038 0t0 TCP 192.168.122.1:domain (LISTEN)
dnsmasq 4169 nobody 7u IPv4 13039 0t0 UDP 192.168.122.1:domain
cimserver 4172 cimsrvr 7u IPv6 13141 0t0 TCP *:wbem-https (LISTEN)
dhclient 4721 root 5u IPv4 13899 0t0 UDP *:bootpc
sqlplus 5631 oracle 7u IPv4 42558 0t0 UDP localhost.localdomain:52493
httpd 10278 root 3u IPv6 37812 0t0 TCP *:http (LISTEN)
㈡ 数据文件恢复测试
原理：
后台进程会维护一个文件列表、锁定打开的文件
对Oracle而言、如果文件被删除、但该文件句柄尚未被关闭、则可通过lsof输出看到标识为deleted
通过 proc 的文件目录、能找到该文件句柄信息、这便是Oracle的数据文件
[plain] view plaincopyprint?
** 测试之前****
[oracle@temp datafile]$ ls -alh
total 1.3G
drwxr-x--- 2 oracle oinstall 4.0K May 9 20:37 .
drwxr-xr-x 5 oracle oinstall 4.0K Jul 17 2012 ..
-rw-r----- 1 oracle oinstall 101M Jun 19 14:19 o1_mf_example_8050jhm7_.dbf
-rw-r----- 1 oracle oinstall 81M Jun 19 14:19 o1_mf_ggs_data_8rq64t53_.dbf
-rw-r----- 1 oracle oinstall 271M Jun 19 19:00 o1_mf_sysaux_8050fk3w_.dbf
-rw-r----- 1 oracle oinstall 491M Jun 19 18:56 o1_mf_system_8050fk2z_.dbf
-rw-r----- 1 oracle oinstall 33M Jun 17 22:00 o1_mf_temp_8050j34j_.tmp
-rw-r----- 1 oracle oinstall 236M Jun 19 18:59 o1_mf_undotbs1_8050fkc6_.dbf
-rw-r----- 1 oracle oinstall 47M Jun 19 17:12 o1_mf_users_8050fkdh_.dbf
** 看看 dbwr 打开的所有文件 **
[root@temp ~]# ps -ef | grep dbw
oracle 5643 1 0 14:19 ? 00:00:00 ora_dbw0_orcl
root 10741 8274 0 19:00 pts/3 00:00:00 grep dbw
** 运用lsof 列出所有被 dbwr 打开的文件 **
[root@temp ~]# lsof -p 5643
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
oracle 5643 oracle cwd DIR 8,2 4096 1556206 /u01/app/oracle/product/10.2.0/db_1/dbs
oracle 5643 oracle rtd DIR 8,2 4096 2 /
oracle 5643 oracle txt REG 8,2 93362427 1557452 /u01/app/oracle/product/10.2.0/db_1/bin/oracle
oracle 5643 oracle mem REG 8,2 70077 1565448 /u01/app/oracle/product/10.2.0/db_1/lib/libclsra10.so
oracle 5643 oracle mem REG 8,2 50848 389032 /lib/libnss_files-2.5.so
oracle 5643 oracle mem REG 8,2 1544 1555978 /u01/app/oracle/product/10.2.0/db_1/dbs/hc_orcl.dat
oracle 5643 oracle mem REG 8,2 20668 391065 /lib/libdl-2.5.so
oracle 5643 oracle mem REG 8,2 216560 391071 /lib/i686/nosegneg/libm-2.5.so
oracle 5643 oracle mem REG 8,2 1211519 1565413 /u01/app/oracle/product/10.2.0/db_1/lib/libocrb10.so
oracle 5643 oracle mem REG 8,2 130860 390859 /lib/ld-2.5.so
oracle 5643 oracle mem REG 8,2 2632 497850 /usr/lib/libaio.so.1.0.1
oracle 5643 oracle mem REG 8,2 728411 1565414 /u01/app/oracle/product/10.2.0/db_1/lib/libocrutl10.so
oracle 5643 oracle mem REG 8,2 137960 391066 /lib/i686/nosegneg/libpthread-2.5.so
oracle 5643 oracle mem REG 8,2 1706072 391064 /lib/i686/nosegneg/libc-2.5.so
oracle 5643 oracle mem REG 8,2 143485 1006037 /u01/app/oracle/product/10.2.0/db_1/lib/libskgxp10.so
oracle 5643 oracle mem REG 8,2 109740 391078 /lib/libnsl-2.5.so
oracle 5643 oracle mem REG 8,2 854560 1565412 /u01/app/oracle/product/10.2.0/db_1/lib/libocr10.so
oracle 5643 oracle mem REG 8,2 98079 1560689 /u01/app/oracle/product/10.2.0/db_1/lib/libdbcfg10.so
oracle 5643 oracle mem REG 8,2 2365801 1565447 /u01/app/oracle/product/10.2.0/db_1/lib/libhasgen10.so
oracle 5643 oracle mem REG 8,2 8069 1560800 /u01/app/oracle/product/10.2.0/db_1/lib/libskgxn2.so
oracle 5643 oracle mem REG 8,2 5480533 1565995 /u01/app/oracle/product/10.2.0/db_1/lib/libnnz10.so
oracle 5643 oracle mem REG 8,2 9017903 1558479 /u01/app/oracle/product/10.2.0/db_1/lib/libjox10.so
oracle 5643 oracle DEL REG 0,9 5603346 /SYSVbe3bb918
oracle 5643 oracle mem CHR 1,5 1559 /dev/zero
oracle 5643 oracle 0r CHR 1,3 0t0 1557 /dev/null
oracle 5643 oracle 1r CHR 1,3 0t0 1557 /dev/null
oracle 5643 oracle 2r CHR 1,3 0t0 1557 /dev/null
oracle 5643 oracle 3r CHR 1,3 0t0 1557 /dev/null
oracle 5643 oracle 4r CHR 1,3 0t0 1557 /dev/null
oracle 5643 oracle 5w REG 8,2 624 1206137 /u01/app/oracle/admin/orcl/udump/orcl_ora_5634.trc
oracle 5643 oracle 6w REG 8,2 232742 324300 /u01/app/oracle/admin/orcl/bdump/alert_orcl.log
oracle 5643 oracle 7u REG 8,2 0 1169911 /u01/app/oracle/product/10.2.0/db_1/dbs/lkinstorcl (deleted)
oracle 5643 oracle 8w REG 8,2 232742 324300 /u01/app/oracle/admin/orcl/bdump/alert_orcl.log
oracle 5643 oracle 9u REG 8,2 1544 1555978 /u01/app/oracle/product/10.2.0/db_1/dbs/hc_orcl.dat
oracle 5643 oracle 10u REG 8,2 1298 230930 /u01/app/oracle/admin/orcl/adump/ora_5634.aud
oracle 5643 oracle 11r CHR 1,5 0t0 1559 /dev/zero
oracle 5643 oracle 12r CHR 1,5 0t0 1559 /dev/zero
oracle 5643 oracle 13r REG 8,2 834560 1565481 /u01/app/oracle/product/10.2.0/db_1/rdbms/mesg/oraus.msb
oracle 5643 oracle 14u REG 8,2 1544 1555978 /u01/app/oracle/product/10.2.0/db_1/dbs/hc_orcl.dat
oracle 5643 oracle 15uR REG 8,2 24 1555979 /u01/app/oracle/product/10.2.0/db_1/dbs/lkORCL
oracle 5643 oracle 16u REG 8,2 7094272 1977496 /u01/app/oracle/oradata/ORCL/controlfile/o1_mf_823mrrdo_.ctl
oracle 5643 oracle 17u REG 8,2 7094272 1851190 /u01/app/oracle/flash_recovery_area/ORCL/controlfile/o1_mf_823mrrrp_.ctl
oracle 5643 oracle 18uW REG 8,2 513810432 1977493 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_system_8050fk2z_.dbf
oracle 5643 oracle 19uW REG 8,2 246423552 1977494 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_undotbs1_8050fkc6_.dbf
oracle 5643 oracle 20uW REG 8,2 283123712 1977489 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_sysaux_8050fk3w_.dbf
oracle 5643 oracle 21uW REG 8,2 48504832 1977490 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_users_8050fkdh_.dbf
oracle 5643 oracle 22uW REG 8,2 104865792 1977491 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_example_8050jhm7_.dbf
oracle 5643 oracle 23uW REG 8,2 83894272 1977501 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf (deleted)
oracle 5643 oracle 24uW REG 8,2 33562624 1977492 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_temp_8050j34j_.tmp
oracle 5643 oracle 25r REG 8,2 834560 1565481 /u01/app/oracle/product/10.2.0/db_1/rdbms/mesg/oraus.msb
** 把 o1_mf_ggs_data_8rq64t53_.dbf 删除 **
[oracle@temp datafile]$ rm -rf o1_mf_ggs_data_8rq64t53_.dbf
** 列出23 号文件句柄的信息 ***
[root@temp ~]# ls -alh /proc/5643/fd/23
lrwx------ 1 oracle oinstall 64 06-19 18:08 /proc/5643/fd/23 -> /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf (deleted)
** 直接复制过去就行了 **
[root@temp ~]# cp /proc/5643/fd/23 /u01/app/oracle/oradata/ORCL/datafile/
[root@temp ~]# chown -R oracle:oinstall /u01/app/oracle/oradata/ORCL/datafile/23
*** 重命名 *****
[oracle@temp datafile]$ ls -l
total 1283716
-rw-r----- 1 oracle oinstall 83894272 Jun 19 19:11 23
-rw-r----- 1 oracle oinstall 104865792 Jun 19 14:19 o1_mf_example_8050jhm7_.dbf
-rw-r----- 1 oracle oinstall 283123712 Jun 19 19:12 o1_mf_sysaux_8050fk3w_.dbf
-rw-r----- 1 oracle oinstall 513810432 Jun 19 19:12 o1_mf_system_8050fk2z_.dbf
-rw-r----- 1 oracle oinstall 33562624 Jun 17 22:00 o1_mf_temp_8050j34j_.tmp
-rw-r----- 1 oracle oinstall 246423552 Jun 19 19:12 o1_mf_undotbs1_8050fkc6_.dbf
-rw-r----- 1 oracle oinstall 48504832 Jun 19 17:12 o1_mf_users_8050fkdh_.dbf
[oracle@temp datafile]$ mv 23 o1_mf_ggs_data_8rq64t53_.dbf
[oracle@temp datafile]$ ls -alh
total 1.3G
drwxr-x--- 2 oracle oinstall 4.0K Jun 19 19:14 .
drwxr-xr-x 5 oracle oinstall 4.0K Jul 17 2012 ..
-rw-r----- 1 oracle oinstall 101M Jun 19 14:19 o1_mf_example_8050jhm7_.dbf
-rw-r----- 1 oracle oinstall 81M Jun 19 19:11 o1_mf_ggs_data_8rq64t53_.dbf
-rw-r----- 1 oracle oinstall 271M Jun 19 19:13 o1_mf_sysaux_8050fk3w_.dbf
-rw-r----- 1 oracle oinstall 491M Jun 19 19:13 o1_mf_system_8050fk2z_.dbf
-rw-r----- 1 oracle oinstall 33M Jun 17 22:00 o1_mf_temp_8050j34j_.tmp
-rw-r----- 1 oracle oinstall 236M Jun 19 19:13 o1_mf_undotbs1_8050fkc6_.dbf
-rw-r----- 1 oracle oinstall 47M Jun 19 17:12 o1_mf_users_8050fkdh_.dbf
** 查看状态 **
sys@ORCL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
sys@ORCL> startup
ORACLE instance started.
Total System Global Area 419430400 bytes
Fixed Size 1219760 bytes
Variable Size 104858448 bytes
Database Buffers 310378496 bytes
Redo Buffers 2973696 bytes
Database mounted.
ORA-01113: file 6 needs media recovery
ORA-01110: data file 6: '/u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf'
sys@ORCL> recover datafile 6;
Media recovery complete.
sys@ORCL> alter database open;
Database altered.
sys@ORCL> select file_name,status from dba_data_files where FILE_ID=6;
FILE_NAME STATUS
-------------------------------------------------------------------- ---------
① 查找指定端口被哪个程序占用：
[plain] view plaincopyprint?
[root@temp ~]# lsof -i :80
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 10278 root 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10280 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10281 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10282 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10283 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10284 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10285 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10286 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
httpd 10287 apache 3u IPv6 37812 0t0 TCP *:http (LISTEN)
② 查找指定文件正在被谁使用：
[plain] view plaincopyprint?
[root@temp ~]# lsof /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
oracle 11239 oracle 23uW REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf
oracle 11241 oracle 29u REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf
oracle 11245 oracle 21u REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf
oracle 11251 oracle 22u REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf
oracle 11260 oracle 19u REG 8,2 83894272 1169914 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf
③ 查找某个用户打开的文件
[plain] view plaincopyprint?
[root@temp ~]# lsof -u oracle
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
bash 5601 oracle cwd DIR 8,2 4096 1491645 /home/oracle
bash 5601 oracle rtd DIR 8,2 4096 2 /
bash 5601 oracle txt REG 8,2 735804 1782911 /bin/bash
bash 5601 oracle mem REG 8,2 5436 584246 /usr/lib/gconv/ISO8859-1.so
bash 5601 oracle mem REG 8,2 130860 390859 /lib/ld-2.5.so
bash 5601 oracle mem REG 8,2 1706072 391064 /lib/i686/nosegneg/libc-2.5.so
bash 5601 oracle mem REG 8,2 20668 391065 /lib/libdl-2.5.so
bash 5601 oracle mem REG 8,2 13276 391090 /lib/libtermcap.so.2.0.8
bash 5601 oracle mem REG 8,2 50848 389032 /lib/libnss_files-2.5.so
bash 5601 oracle mem REG 8,2 25462 584323 /usr/lib/gconv/gconv-modules.cache
bash 5601 oracle mem REG 8,2 56449792 491499 /usr/lib/locale/locale-archive
bash 5601 oracle 0u CHR 136,1 0t0 3 /dev/pts/1
.....................
................
④ 查找某个程序现在正打开的文件
[plain] view plaincopyprint?
-c：程序名
-p：pid
[root@temp ~]# lsof -c init
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
init 1 root cwd DIR 8,2 4096 2 /
init 1 root rtd DIR 8,2 4096 2 /
init 1 root txt REG 8,2 38652 1620888 /sbin/init
init 1 root mem REG 8,2 130860 390859 /lib/ld-2.5.so
init 1 root mem REG 8,2 1706072 391064 /lib/i686/nosegneg/libc-2.5.so
init 1 root mem REG 8,2 20668 391065 /lib/libdl-2.5.so
init 1 root mem REG 8,2 245376 391081 /lib/libsepol.so.1
init 1 root mem REG 8,2 93508 391082 /lib/libselinux.so.1
init 1 root 10u FIFO 0,16 0t0 1322 /dev/initctl
⑤ 查找某个用户的所有网络连接
[plain] view plaincopyprint?
[root@temp ~]# lsof -a -u oracle -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sqlplus 5631 oracle 7u IPv4 42558 0t0 UDP localhost.localdomain:52493
oracle 11233 oracle 15u IPv4 42442 0t0 UDP localhost.localdomain:62999
oracle 11255 oracle 14u IPv4 42529 0t0 UDP localhost.localdomain:18473
oracle 11255 oracle 15u IPv4 42530 0t0 TCP *:4048 (LISTEN)
oracle 11257 oracle 14u IPv4 42540 0t0 UDP localhost.localdomain:8690
oracle 11260 oracle 22u IPv4 42728 0t0 UDP *:12147
⑥ 查找所有打开的网络连接
[plain] view plaincopyprint?
类似的：
lsof -i tcp
lsof -i udp
lsof -i tcp:80
[root@temp ~]# lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
cupsd 3062 root 4u IPv4 8720 0t0 TCP localhost.localdomain:ipp (LISTEN)
cupsd 3062 root 6u IPv4 8723 0t0 UDP *:ipp
portmap 3600 rpc 3u IPv4 9798 0t0 UDP *:sunrpc
portmap 3600 rpc 4u IPv4 9799 0t0 TCP *:sunrpc (LISTEN)
rpc.statd 3636 rpcuser 3u IPv4 9992 0t0 UDP *:dhcp-failover2
rpc.statd 3636 rpcuser 6u IPv4 9978 0t0 UDP *:844
rpc.statd 3636 rpcuser 7u IPv4 10005 0t0 TCP *:850 (LISTEN)
hpiod 3890 root 0u IPv4 12249 0t0 TCP localhost.localdomain:2208 (LISTEN)
hpssd.py 3895 root 4u IPv4 12267 0t0 TCP localhost.localdomain:2207 (LISTEN)
sshd 3908 root 3u IPv6 12303 0t0 TCP *:ssh (LISTEN)
sshd 3908 root 4u IPv4 12305 0t0 TCP *:ssh (LISTEN)
sendmail 3939 root 4u IPv4 12415 0t0 TCP localhost.localdomain:smtp (LISTEN)
avahi-dae 4149 avahi 13u IPv4 12875 0t0 UDP *:mdns
avahi-dae 4149 avahi 14u IPv6 12876 0t0 UDP *:mdns
avahi-dae 4149 avahi 15u IPv4 12877 0t0 UDP *:8990
avahi-dae 4149 avahi 16u IPv6 12878 0t0 UDP *:6857
dnsmasq 4169 nobody 5u IPv4 13032 0t0 UDP *:bootps
dnsmasq 4169 nobody 6u IPv4 13038 0t0 TCP 192.168.122.1:domain (LISTEN)
dnsmasq 4169 nobody 7u IPv4 13039 0t0 UDP 192.168.122.1:domain
cimserver 4172 cimsrvr 7u IPv6 13141 0t0 TCP *:wbem-https (LISTEN)
dhclient 4721 root 5u IPv4 13899 0t0 UDP *:bootpc
sqlplus 5631 oracle 7u IPv4 42558 0t0 UDP localhost.localdomain:52493
httpd 10278 root 3u IPv6 37812 0t0 TCP *:http (LISTEN)
㈡ 数据文件恢复测试
原理：
后台进程会维护一个文件列表、锁定打开的文件
对Oracle而言、如果文件被删除、但该文件句柄尚未被关闭、则可通过lsof输出看到标识为deleted
通过 proc 的文件目录、能找到该文件句柄信息、这便是Oracle的数据文件
[plain] view plaincopyprint?
** 测试之前****
[oracle@temp datafile]$ ls -alh
total 1.3G
drwxr-x--- 2 oracle oinstall 4.0K May 9 20:37 .
drwxr-xr-x 5 oracle oinstall 4.0K Jul 17 2012 ..
-rw-r----- 1 oracle oinstall 101M Jun 19 14:19 o1_mf_example_8050jhm7_.dbf
-rw-r----- 1 oracle oinstall 81M Jun 19 14:19 o1_mf_ggs_data_8rq64t53_.dbf
-rw-r----- 1 oracle oinstall 271M Jun 19 19:00 o1_mf_sysaux_8050fk3w_.dbf
-rw-r----- 1 oracle oinstall 491M Jun 19 18:56 o1_mf_system_8050fk2z_.dbf
-rw-r----- 1 oracle oinstall 33M Jun 17 22:00 o1_mf_temp_8050j34j_.tmp
-rw-r----- 1 oracle oinstall 236M Jun 19 18:59 o1_mf_undotbs1_8050fkc6_.dbf
-rw-r----- 1 oracle oinstall 47M Jun 19 17:12 o1_mf_users_8050fkdh_.dbf
** 看看 dbwr 打开的所有文件 **
[root@temp ~]# ps -ef | grep dbw
oracle 5643 1 0 14:19 ? 00:00:00 ora_dbw0_orcl
root 10741 8274 0 19:00 pts/3 00:00:00 grep dbw
** 运用lsof 列出所有被 dbwr 打开的文件 **
[root@temp ~]# lsof -p 5643
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
oracle 5643 oracle cwd DIR 8,2 4096 1556206 /u01/app/oracle/product/10.2.0/db_1/dbs
oracle 5643 oracle rtd DIR 8,2 4096 2 /
oracle 5643 oracle txt REG 8,2 93362427 1557452 /u01/app/oracle/product/10.2.0/db_1/bin/oracle
oracle 5643 oracle mem REG 8,2 70077 1565448 /u01/app/oracle/product/10.2.0/db_1/lib/libclsra10.so
oracle 5643 oracle mem REG 8,2 50848 389032 /lib/libnss_files-2.5.so
oracle 5643 oracle mem REG 8,2 1544 1555978 /u01/app/oracle/product/10.2.0/db_1/dbs/hc_orcl.dat
oracle 5643 oracle mem REG 8,2 20668 391065 /lib/libdl-2.5.so
oracle 5643 oracle mem REG 8,2 216560 391071 /lib/i686/nosegneg/libm-2.5.so
oracle 5643 oracle mem REG 8,2 1211519 1565413 /u01/app/oracle/product/10.2.0/db_1/lib/libocrb10.so
oracle 5643 oracle mem REG 8,2 130860 390859 /lib/ld-2.5.so
oracle 5643 oracle mem REG 8,2 2632 497850 /usr/lib/libaio.so.1.0.1
oracle 5643 oracle mem REG 8,2 728411 1565414 /u01/app/oracle/product/10.2.0/db_1/lib/libocrutl10.so
oracle 5643 oracle mem REG 8,2 137960 391066 /lib/i686/nosegneg/libpthread-2.5.so
oracle 5643 oracle mem REG 8,2 1706072 391064 /lib/i686/nosegneg/libc-2.5.so
oracle 5643 oracle mem REG 8,2 143485 1006037 /u01/app/oracle/product/10.2.0/db_1/lib/libskgxp10.so
oracle 5643 oracle mem REG 8,2 109740 391078 /lib/libnsl-2.5.so
oracle 5643 oracle mem REG 8,2 854560 1565412 /u01/app/oracle/product/10.2.0/db_1/lib/libocr10.so
oracle 5643 oracle mem REG 8,2 98079 1560689 /u01/app/oracle/product/10.2.0/db_1/lib/libdbcfg10.so
oracle 5643 oracle mem REG 8,2 2365801 1565447 /u01/app/oracle/product/10.2.0/db_1/lib/libhasgen10.so
oracle 5643 oracle mem REG 8,2 8069 1560800 /u01/app/oracle/product/10.2.0/db_1/lib/libskgxn2.so
oracle 5643 oracle mem REG 8,2 5480533 1565995 /u01/app/oracle/product/10.2.0/db_1/lib/libnnz10.so
oracle 5643 oracle mem REG 8,2 9017903 1558479 /u01/app/oracle/product/10.2.0/db_1/lib/libjox10.so
oracle 5643 oracle DEL REG 0,9 5603346 /SYSVbe3bb918
oracle 5643 oracle mem CHR 1,5 1559 /dev/zero
oracle 5643 oracle 0r CHR 1,3 0t0 1557 /dev/null
oracle 5643 oracle 1r CHR 1,3 0t0 1557 /dev/null
oracle 5643 oracle 2r CHR 1,3 0t0 1557 /dev/null
oracle 5643 oracle 3r CHR 1,3 0t0 1557 /dev/null
oracle 5643 oracle 4r CHR 1,3 0t0 1557 /dev/null
oracle 5643 oracle 5w REG 8,2 624 1206137 /u01/app/oracle/admin/orcl/udump/orcl_ora_5634.trc
oracle 5643 oracle 6w REG 8,2 232742 324300 /u01/app/oracle/admin/orcl/bdump/alert_orcl.log
oracle 5643 oracle 7u REG 8,2 0 1169911 /u01/app/oracle/product/10.2.0/db_1/dbs/lkinstorcl (deleted)
oracle 5643 oracle 8w REG 8,2 232742 324300 /u01/app/oracle/admin/orcl/bdump/alert_orcl.log
oracle 5643 oracle 9u REG 8,2 1544 1555978 /u01/app/oracle/product/10.2.0/db_1/dbs/hc_orcl.dat
oracle 5643 oracle 10u REG 8,2 1298 230930 /u01/app/oracle/admin/orcl/adump/ora_5634.aud
oracle 5643 oracle 11r CHR 1,5 0t0 1559 /dev/zero
oracle 5643 oracle 12r CHR 1,5 0t0 1559 /dev/zero
oracle 5643 oracle 13r REG 8,2 834560 1565481 /u01/app/oracle/product/10.2.0/db_1/rdbms/mesg/oraus.msb
oracle 5643 oracle 14u REG 8,2 1544 1555978 /u01/app/oracle/product/10.2.0/db_1/dbs/hc_orcl.dat
oracle 5643 oracle 15uR REG 8,2 24 1555979 /u01/app/oracle/product/10.2.0/db_1/dbs/lkORCL
oracle 5643 oracle 16u REG 8,2 7094272 1977496 /u01/app/oracle/oradata/ORCL/controlfile/o1_mf_823mrrdo_.ctl
oracle 5643 oracle 17u REG 8,2 7094272 1851190 /u01/app/oracle/flash_recovery_area/ORCL/controlfile/o1_mf_823mrrrp_.ctl
oracle 5643 oracle 18uW REG 8,2 513810432 1977493 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_system_8050fk2z_.dbf
oracle 5643 oracle 19uW REG 8,2 246423552 1977494 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_undotbs1_8050fkc6_.dbf
oracle 5643 oracle 20uW REG 8,2 283123712 1977489 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_sysaux_8050fk3w_.dbf
oracle 5643 oracle 21uW REG 8,2 48504832 1977490 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_users_8050fkdh_.dbf
oracle 5643 oracle 22uW REG 8,2 104865792 1977491 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_example_8050jhm7_.dbf
oracle 5643 oracle 23uW REG 8,2 83894272 1977501 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf (deleted)
oracle 5643 oracle 24uW REG 8,2 33562624 1977492 /u01/app/oracle/oradata/ORCL/datafile/o1_mf_temp_8050j34j_.tmp
oracle 5643 oracle 25r REG 8,2 834560 1565481 /u01/app/oracle/product/10.2.0/db_1/rdbms/mesg/oraus.msb
** 把 o1_mf_ggs_data_8rq64t53_.dbf 删除 **
[oracle@temp datafile]$ rm -rf o1_mf_ggs_data_8rq64t53_.dbf
** 列出23 号文件句柄的信息 ***
[root@temp ~]# ls -alh /proc/5643/fd/23
lrwx------ 1 oracle oinstall 64 06-19 18:08 /proc/5643/fd/23 -> /u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf (deleted)
** 直接复制过去就行了 **
[root@temp ~]# cp /proc/5643/fd/23 /u01/app/oracle/oradata/ORCL/datafile/
[root@temp ~]# chown -R oracle:oinstall /u01/app/oracle/oradata/ORCL/datafile/23
*** 重命名 *****
[oracle@temp datafile]$ ls -l
total 1283716
-rw-r----- 1 oracle oinstall 83894272 Jun 19 19:11 23
-rw-r----- 1 oracle oinstall 104865792 Jun 19 14:19 o1_mf_example_8050jhm7_.dbf
-rw-r----- 1 oracle oinstall 283123712 Jun 19 19:12 o1_mf_sysaux_8050fk3w_.dbf
-rw-r----- 1 oracle oinstall 513810432 Jun 19 19:12 o1_mf_system_8050fk2z_.dbf
-rw-r----- 1 oracle oinstall 33562624 Jun 17 22:00 o1_mf_temp_8050j34j_.tmp
-rw-r----- 1 oracle oinstall 246423552 Jun 19 19:12 o1_mf_undotbs1_8050fkc6_.dbf
-rw-r----- 1 oracle oinstall 48504832 Jun 19 17:12 o1_mf_users_8050fkdh_.dbf
[oracle@temp datafile]$ mv 23 o1_mf_ggs_data_8rq64t53_.dbf
[oracle@temp datafile]$ ls -alh
total 1.3G
drwxr-x--- 2 oracle oinstall 4.0K Jun 19 19:14 .
drwxr-xr-x 5 oracle oinstall 4.0K Jul 17 2012 ..
-rw-r----- 1 oracle oinstall 101M Jun 19 14:19 o1_mf_example_8050jhm7_.dbf
-rw-r----- 1 oracle oinstall 81M Jun 19 19:11 o1_mf_ggs_data_8rq64t53_.dbf
-rw-r----- 1 oracle oinstall 271M Jun 19 19:13 o1_mf_sysaux_8050fk3w_.dbf
-rw-r----- 1 oracle oinstall 491M Jun 19 19:13 o1_mf_system_8050fk2z_.dbf
-rw-r----- 1 oracle oinstall 33M Jun 17 22:00 o1_mf_temp_8050j34j_.tmp
-rw-r----- 1 oracle oinstall 236M Jun 19 19:13 o1_mf_undotbs1_8050fkc6_.dbf
-rw-r----- 1 oracle oinstall 47M Jun 19 17:12 o1_mf_users_8050fkdh_.dbf
** 查看状态 **
sys@ORCL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
sys@ORCL> startup
ORACLE instance started.
Total System Global Area 419430400 bytes
Fixed Size 1219760 bytes
Variable Size 104858448 bytes
Database Buffers 310378496 bytes
Redo Buffers 2973696 bytes
Database mounted.
ORA-01113: file 6 needs media recovery
ORA-01110: data file 6: '/u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf'
sys@ORCL> recover datafile 6;
Media recovery complete.
sys@ORCL> alter database open;
Database altered.
sys@ORCL> select file_name,status from dba_data_files where FILE_ID=6;
FILE_NAME STATUS
-------------------------------------------------------------------- ---------
/u01/app/oracle/oradata/ORCL/datafile/o1_mf_ggs_data_8rq64t53_.dbf AVAILABLE
原文地址：http://blog.csdn.net/dba_waterbin/article/details/9132431
- lsof 应用实例分享以及Oracle 数据文件删除恢复测试
- lsof 应用实例分享以及Oracle 数据文件删除恢复测试
- Oracle 意外删除数据文件的恢复
- ORACLE 删除数据文件模拟灾难恢复
- oracle数据文件被删除没备份恢复
- Oracle意外删除数据文件恢复方法
- oracle数据文件被删除的恢复
- linux 误删除Oracle数据文件恢复
- 继续lsof删除恢复
- lsof恢复删除的文件
- oracle误用操作系统命令删除数据文件的恢复方法
- Linux下ORACLE误删除数据文件恢复操作
- oracle数据文件被误操作删除了恢复方法
- Oracle数据库数据文件rm -rf误删除后恢复
- 【转载】linux中误删除oracle数据文件的恢复操作
- 使用linux文件句柄恢复误删除的Oracle数据文件
- Linux中模拟oracle数据文件的误删除与恢复
- Oracle数据库数据文件rm -rf误删除后恢复
- Linux&VMware&vBox&虚拟化技术资料汇总
- [oralce] 利用CRT的端口转发功能直接用plsql访问数据库
- 在Linux上配置Apache HTTPS服务
- Android之自动化压力测试工具：Monkey的使用
- Android ListView反复调用getView和getCount
- lsof 应用实例分享以及Oracle 数据文件删除恢复测试
- C指针原理（20）-C指针基础
- jsp textarea删除一行或者多行(textarea删除某行)
- Unknown column 'conuintoken' in 'field list' 解决办法
- 用PHP将CMYK格式的JPG文件转为RGB格式
- 函数指针
- 按位与、或、异或等运算总结
- Java重载可以有不同的返回类型
- 二维数组--char5
