联系：手机/微信(+86 17813235971) QQ(107644445)
标题：helpservis@horsefucker.org加密恢复
作者：惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]
最近有客户环境中大量服务器被感染类似如下病毒,邮箱为:helpservis@horsefucker.org,每个机器不一样的id,使用该id为文件后缀名
16进制方式打开文件头发现破坏如下
E-Mail:dba@xifenfei.com
联系：手机/微信(+86 17813235971) QQ(107644445)
标题：xfs删除数据文件恢复
作者：惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]
在linux7的环境（xfs文件系统格式）中,由于误操作执行了rm -rf /操作,导致系统大部分文件被删除（oracle数据库相关文件）.我们对其现场进行分析,确认相关数据在磁盘底层依旧存在
联系：手机/微信(+86 17813235971) QQ(107644445)
作者：惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]
Oracle 19.3数据库打最新补丁报错
[oracle@www.xifenfei.com 30125133]$ opatch apply ./ Oracle Interim Patch Installer version 12.2.0.1.18 Copyright (c) 2019, Oracle Corporation. All rights reserved. Oracle Home : /u01/app/oracle/product/19.0/db_1 Central Inventory : /u01/app/oraInventory from : /u01/app/oracle/product/19.0/db_1/oraInst.loc OPatch version : 12.2.0.1.18 OUI version : 12.2.0.7.0 Log file location : /u01/app/oracle/product/19.0/db_1/cfgtoollogs/opatch/opatch2019-12-16_08-00-53AM_1.log
分析日志
Verifying environment and performing prerequisite checks...
Prerequisite check "CheckSystemCommandAvailable" failed.
The details are:
Missing command :fuser
UtilSession failed:
Prerequisite check "CheckSystemCommandAvailable" failed.
Log file location: /u01/app/oracle/product/19.0/db_1/cfgtoollogs/opatch/opatch2019-12-16_08-00-53AM_1.log
OPatch failed with error code 73
[Dec 16, 2019 8:00:57 AM] [INFO] Following patches can be applied: 30125133
[Dec 16, 2019 8:00:57 AM] [INFO] Following patches are not required:
[Dec 16, 2019 8:00:57 AM] [INFO] Following patches are auto rollbackable:
[Dec 16, 2019 8:00:57 AM] [INFO] Finished checking prereq checkConflictAgainstOHWithDetail
[Dec 16, 2019 8:00:58 AM] [INFO] Running prerequisite checks...
[Dec 16, 2019 8:00:58 AM] [INFO] Space Needed : 3052.647MB
[Dec 16, 2019 8:00:58 AM] [INFO] Missing command :fuser
[Dec 16, 2019 8:00:58 AM] [INFO] Prerequisite check "CheckSystemCommandAvailable" failed.
The details are:
Missing command :fuser
[Dec 16, 2019 8:00:58 AM] [SEVERE] OUI-67073:UtilSession failed:
Prerequisite check "CheckSystemCommandAvailable" failed.
基本上可以确定是由于无fuser命令导致CheckSystemCommandAvailable失败.处理办法为安装上相关程序
[root@www.xifenfei.com tmp]# yum search fuser Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager to register. ==================================== Matched: fuser =========================== psmisc.x86_64 : Utilities for managing processes on your system [root@www.xifenfei.com tmp]# [root@www.xifenfei.com tmp]# mount /dev/cdrom /media/ -o loop [root@www.xifenfei.com tmp]# yum install -y psmisc Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager to register. rhel-yum | 4.3 kB 00:00:00 Resolving Dependencies --> Running transaction check ---> Package psmisc.x86_64 0:22.20-15.el7 will be installed --> Finished Dependency Resolution Dependencies Resolved ============================================================================================= Package Arch Version Repository Size ============================================================================================= Installing: psmisc x86_64 22.20-15.el7 rhel-yum 141 k Transaction Summary ============================================================================================= Install 1 Package Total download size: 141 k Installed size: 475 k Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : psmisc-22.20-15.el7.x86_64 1/1 Verifying : psmisc-22.20-15.el7.x86_64 1/1 Installed: psmisc.x86_64 0:22.20-15.el7 Complete!
重新打补丁
[oracle@www.xifenfei.com 30125133]$ opatch apply ./ Oracle Interim Patch Installer version 12.2.0.1.18 Copyright (c) 2019, Oracle Corporation. All rights reserved. Oracle Home : /u01/app/oracle/product/19.0/db_1 Central Inventory : /u01/app/oraInventory from : /u01/app/oracle/product/19.0/db_1/oraInst.loc OPatch version : 12.2.0.1.18 OUI version : 12.2.0.7.0 Log file location : /u01/app/oracle/product/19.0/db_1/cfgtoollogs/opatch/opatch2019-12-16_08-08-44AM_1.log Verifying environment and performing prerequisite checks... OPatch continues with these patches: 30125133 Do you want to proceed? [y|n] y User Responded with: Y All checks passed. Please shutdown Oracle instances running out of this ORACLE_HOME on the local system. (Oracle Home = '/u01/app/oracle/product/19.0/db_1') Is the local system ready for patching? [y|n] y User Responded with: Y Backing up files... Applying interim patch '30125133' to OH '/u01/app/oracle/product/19.0/db_1' ApplySession: Optional component(s) [ oracle.network.gsm, 19.0.0.0.0 ],[ oracle.rdbms.ic, 19.0.0.0.0 ], [ oracle.network.cman, 19.0.0.0.0 ],[ oracle.net.cman, 19.0.0.0.0 ],[ oracle.options.olap.awm, 19.0.0.0.0], [ oracle.oraolap.mgmt, 19.0.0.0.0 ],[ oracle.assistants.usm, 19.0.0.0.0 ],[ oracle.assistants.asm, 19.0.0.0.0], [ oracle.tfa, 19.0.0.0.0 ] not present in the Oracle Home or a higher version is found. Patching component oracle.rdbms, 19.0.0.0.0... Patching component oracle.rdbms.rsf, 19.0.0.0.0... Patching component oracle.assistants.acf, 19.0.0.0.0... Patching component oracle.assistants.deconfig, 19.0.0.0.0... Patching component oracle.assistants.server, 19.0.0.0.0... Patching component oracle.buildtools.rsf, 19.0.0.0.0... Patching component oracle.ctx, 19.0.0.0.0... Patching component oracle.ldap.rsf, 19.0.0.0.0... Patching component oracle.network.rsf, 19.0.0.0.0... Patching component oracle.rdbms.dbscripts, 19.0.0.0.0... Patching component oracle.sdo, 19.0.0.0.0... Patching component oracle.sqlplus, 19.0.0.0.0... Patching component oracle.ldap.rsf.ic, 19.0.0.0.0... Patching component oracle.rdbms.rman, 19.0.0.0.0... Patching component oracle.ctx.atg, 19.0.0.0.0... Patching component oracle.rdbms.oci, 19.0.0.0.0... Patching component oracle.rdbms.util, 19.0.0.0.0... Patching component oracle.xdk, 19.0.0.0.0... Patching component oracle.ovm, 19.0.0.0.0... Patching component oracle.network.listener, 19.0.0.0.0... Patching component oracle.rdbms.install.plugins, 19.0.0.0.0... Patching component oracle.dbjava.jdbc, 19.0.0.0.0... Patching component oracle.dbdev, 19.0.0.0.0... Patching component oracle.rdbms.deconfig, 19.0.0.0.0... Patching component oracle.nlsrtl.rsf, 19.0.0.0.0... Patching component oracle.oraolap.dbscripts, 19.0.0.0.0... Patching component oracle.install.deinstalltool, 19.0.0.0.0... Patching component oracle.dbjava.ic, 19.0.0.0.0... Patching component oracle.sdo.locator, 19.0.0.0.0... Patching component oracle.rdbms.scheduler, 19.0.0.0.0... Patching component oracle.rdbms.dv, 19.0.0.0.0... Patching component oracle.ons, 19.0.0.0.0... Patching component oracle.ldap.security.osdt, 19.0.0.0.0... Patching component oracle.ctx.rsf, 19.0.0.0.0... Patching component oracle.duma, 19.0.0.0.0... Patching component oracle.ldap.owm, 19.0.0.0.0... Patching component oracle.oracore.rsf, 19.0.0.0.0... Patching component oracle.rdbms.install.seeddb, 19.0.0.0.0... Patching component oracle.odbc, 19.0.0.0.0... Patching component oracle.sdo.locator.jrf, 19.0.0.0.0... Patching component oracle.network.client, 19.0.0.0.0... Patching component oracle.sqlplus.ic, 19.0.0.0.0... Patching component oracle.dbjava.ucp, 19.0.0.0.0... Patching component oracle.xdk.rsf, 19.0.0.0.0... Patching component oracle.marvel, 19.0.0.0.0... Patching component oracle.xdk.parser.java, 19.0.0.0.0... Patching component oracle.rdbms.rsf.ic, 19.0.0.0.0... Patching component oracle.nlsrtl.rsf.core, 19.0.0.0.0... Patching component oracle.precomp.common, 19.0.0.0.0... Patching component oracle.precomp.lang, 19.0.0.0.0... Patch 30125133 successfully applied. Sub-set patch [29517242] has become inactive due to the application of a super-set patch [30125133]. Please refer to Doc ID 2161861.1 for any possible further required actions. Log file location: /u01/app/oracle/product/19.0/db_1/cfgtoollogs/opatch/opatch2019-12-16_08-08-44AM_1.log OPatch succeeded. [oracle@www.xifenfei.com 30128191]$ opatch apply ./ Oracle Interim Patch Installer version 12.2.0.1.18 Copyright (c) 2019, Oracle Corporation. All rights reserved. Oracle Home : /u01/app/oracle/product/19.0/db_1 Central Inventory : /u01/app/oraInventory from : /u01/app/oracle/product/19.0/db_1/oraInst.loc OPatch version : 12.2.0.1.18 OUI version : 12.2.0.7.0 Log file location : /u01/app/oracle/product/19.0/db_1/cfgtoollogs/opatch/opatch2019-12-16_08-12-44AM_1.log Verifying environment and performing prerequisite checks... OPatch continues with these patches: 30128191 Do you want to proceed? [y|n] y User Responded with: Y All checks passed. Please shutdown Oracle instances running out of this ORACLE_HOME on the local system. (Oracle Home = '/u01/app/oracle/product/19.0/db_1') Is the local system ready for patching? [y|n] y User Responded with: Y Backing up files... Applying interim patch '30128191' to OH '/u01/app/oracle/product/19.0/db_1' Patching component oracle.javavm.server, 19.0.0.0.0... Patching component oracle.javavm.server.core, 19.0.0.0.0... Patching component oracle.rdbms.dbscripts, 19.0.0.0.0... Patching component oracle.rdbms, 19.0.0.0.0... Patch 30128191 successfully applied. Log file location: /u01/app/oracle/product/19.0/db_1/cfgtoollogs/opatch/opatch2019-12-16_08-12-44AM_1.log OPatch succeeded.
确认补丁安装成功
[oracle@www.xifenfei.com 30128191]$ opatch lspatches 30128191;OJVM RELEASE UPDATE: 19.5.0.0.191015 (30128191) 30125133;Database Release Update : 19.5.0.0.191015 (30125133) 29585399;OCW RELEASE UPDATE 19.3.0.0.0 (29585399) OPatch succeeded.
mos上也有类似文章可参考:Prerequisite check “CheckSystemCommandAvailable” failed (Doc ID 1581604.1)
联系：手机/微信(+86 17813235971) QQ(107644445)
标题：.megac加密恢复
作者：惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]
oracle数据库被加密为.megac.megac后缀名,加密情况如下:
E-Mail:dba@xifenfei.com
标题：dbca删除库和rm删库恢复
作者：惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]
对于这类删库的操作,一定要保护好现场,对数据文件存在分区不要有二次写操作,尽可能的减少覆盖.理论上数据文件在磁盘上,都可以恢复出来.如果有遇到数据库文件误删除,或者文件系统损坏的恢复需求,无法自行解决,可以联系我们从底层进行恢复:Phone:17813235971 Q Q:107644445 E-Mail:dba@xifenfei.com
类似恢复案例:
又一例asm格式化文件系统恢复
文件系统损坏导致数据文件异常恢复
Oracle 数据文件大小为0kb或者文件丢失恢复
oracle asm disk格式化恢复—格式化为ntfs文件系统
oracle asm disk格式化恢复—格式化为ext4文件系统
ORA-15042: ASM disk “N” is missing from group number “M” 故障恢复
 |
|