ORA-600 kcratr_nab_less_than_odr和ORA-600 4193故障处理

联系:手机/微信(+86 17813235971) QQ(107644445)QQ咨询惜分飞

标题:ORA-600 kcratr_nab_less_than_odr和ORA-600 4193故障处理

作者:惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]

数据库启动报ORA-600 kcratr_nab_less_than_odr

alter database open
Beginning crash recovery of 1 threads
 parallel recovery started with 15 processes
Started redo scan
Completed redo scan
 read 2930 KB redo, 1357 data blocks need recovery
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_19096.trc  (incident=576634):
ORA-00600: ??????, ??: [kcratr_nab_less_than_odr], [1], [7859], [62180], [63172], [], [], [], [], [], [], []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_576634\orcl_ora_19096_i576634.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Aborting crash recovery due to error 600
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_19096.trc:
ORA-00600: ??????, ??: [kcratr_nab_less_than_odr], [1], [7859], [62180], [63172], [], [], [], [], [], [], []
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_ora_19096.trc:
ORA-00600: ??????, ??: [kcratr_nab_less_than_odr], [1], [7859], [62180], [63172], [], [], [], [], [], [], []
ORA-600 signalled during: alter database open...

这个错误一般常见的是11.2.0.1的数据库异常关机了容易遇到
又一例ORA-600 kcratr_nab_less_than_odr
ORA-600 kcratr_nab_less_than_odr故障解决
这个客户是11.2.0.4的库(在这个版本中该错误相对较少,虽然也遇到过几次)
11.2.0.4库中遇到ORA-600 kcratr_nab_less_than_odr报错
分析日志发现是由于之前io比较慢导致写入异常导致

Fri Feb 06 00:32:59 2026
********************* ATTENTION: ******************** 
 The controlfile header block returned by the OS
 has a sequence number that is too old. 
 The controlfile might be corrupted.
 PLEASE DO NOT ATTEMPT TO START UP THE INSTANCE 
 without following the steps below.
 RE-STARTING THE INSTANCE CAN CAUSE SERIOUS DAMAGE 
 TO THE DATABASE, if the controlfile is truly corrupted.
 In order to re-start the instance safely, 
 please do the following:
 (1) Save all copies of the controlfile for later 
     analysis and contact your OS vendor and Oracle support.
 (2) Mount the instance and issue: 
     ALTER DATABASE BACKUP CONTROLFILE TO TRACE;
 (3) Unmount the instance. 
 (4) Use the script in the trace file to
     RE-CREATE THE CONTROLFILE and open the database. 
*****************************************************
CKPT (ospid: 2600): terminating the instance
Fri Feb 06 00:33:00 2026
System state dump requested by (instance=1, osid=2600 (CKPT)), summary=[abnormal instance termination].
System State dumped to trace file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_diag_2488_20260206003300.trc
Fri Feb 06 00:33:01 2026
opiodr aborting process unknown ospid (3420) as a result of ORA-1092

处理这个错误相对比较简单,重建控制文件即可
11


但是后续数据库出现ORA-600 4193错误

Fri Feb 06 02:57:34 2026
ALTER DATABASE OPEN
Thread 1 opened at log sequence 7860
  Current log# 1 seq# 7860 mem# 0: D:\APP\ADMINISTRATOR\ORADATA\orcl\REDO01.LOG
Successful open of redo thread 1
MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
SMON: enabling cache recovery
[4044] Successfully onlined Undo Tablespace 2.
Undo initialization finished serial:0 start:5166812 end:5167140 diff:328 (3 seconds)
Verifying file header compatibility for 11g tablespace encryption..
Verifying 11g file header compatibility for tablespace encryption completed
SMON: enabling tx recovery
Database Characterset is ZHS16GBK
No Resource Manager plan active
replication_dependency_tracking turned off (no async multimaster replication found)
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_smon_3868.trc  (incident=640589):
ORA-00600: 内部错误代码, 参数: [4193], [], [], [], [], [], [], [], [], [], [], []
Incident details in: D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\incident\incdir_640589\orcl_smon_3868_i640589.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Starting background process QMNC
Fri Feb 06 02:57:36 2026
QMNC started with pid=21, OS id=5008 
Completed: ALTER DATABASE OPEN
Fri Feb 06 02:57:37 2026
db_recovery_file_dest_size of 4182 MB is 0.00% used. This is a
user-specified limit on the amount of space that will be used by this
database for recovery-related files, and does not reflect the amount of
space available in the underlying filesystem or ASM diskgroup.
Block recovery from logseq 7860, block 132954 to scn 55142160294
Recovery of Online Redo Log: Thread 1 Group 1 Seq 7860 Reading mem 0
  Mem# 0: D:\APP\ADMINISTRATOR\ORADATA\orcl\REDO01.LOG
Block recovery completed at rba 7860.132998.16, scn 12.3602552743
Block recovery from logseq 7860, block 132954 to scn 55142160257
Recovery of Online Redo Log: Thread 1 Group 1 Seq 7860 Reading mem 0
  Mem# 0: D:\APP\ADMINISTRATOR\ORADATA\orcl\REDO01.LOG
Block recovery completed at rba 7860.132954.16, scn 12.3602552707
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_smon_3868.trc:
ORA-01595: 释放区 (5) 回退段 (21) 时出错
ORA-00600: 内部错误代码, 参数: [4193], [], [], [], [], [], [], [], [], [], [], []
Flush retried for xcb 0x96c82600, pmd 0x8c6a70b8
Block recovery from logseq 7860, block 132954 to scn 55142160294
Recovery of Online Redo Log: Thread 1 Group 1 Seq 7860 Reading mem 0
  Mem# 0: D:\APP\ADMINISTRATOR\ORADATA\orcl\REDO01.LOG
Block recovery completed at rba 7860.132998.16, scn 12.3602552743
Errors in file D:\APP\ADMINISTRATOR\diag\rdbms\orcl\orcl\trace\orcl_pmon_2728.trc:
ORA-00600: 内部错误代码, 参数: [4193], [], [], [], [], [], [], [], [], [], [], []
PMON (ospid: 2728): terminating the instance due to error 472
System state dump requested by (instance=1, osid=2728 (PMON)), summary=[abnormal instance termination].
Fri Feb 06 02:58:17 2026
Instance terminated by PMON, pid = 2728

这个错误相对比较简单,由于undo回滚段异常,处理掉异常undo之后,数据库正常,完成本次恢复任务

aix环境10g由于控制器异常导致ORA-600 4000故障处理

联系:手机/微信(+86 17813235971) QQ(107644445)QQ咨询惜分飞

标题:aix环境10g由于控制器异常导致ORA-600 4000故障处理

作者:惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]

一台运行在aix环境下面的10.2.0.1的数据库
version


由于控制器异常导致数据库启动的时候报ORA-600 4000错误

Wed Jan 28 18:17:06 2026
Completed crash recovery at
 Thread 1: logseq 499321, block 14459, scn 17457591400427
 257 data blocks read, 41 data blocks written, 14457 redo blocks read
Wed Jan 28 18:17:06 2026
Thread 1 advanced to log sequence 499322
Thread 1 opened at log sequence 499322
  Current log# 2 seq# 499322 mem# 0: /dev/rrk_redo2
Successful open of redo thread 1
Wed Jan 28 18:17:06 2026
MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
Wed Jan 28 18:17:06 2026
SMON: enabling cache recovery
Wed Jan 28 18:17:07 2026
Errors in file /u01/app/oracle/admin/orcl1/udump/orcl1_ora_16187632.trc:
ORA-00600: internal error code, arguments: [4000], [9], [], [], [], [], [], []
Wed Jan 28 18:17:08 2026
Errors in file /u01/app/oracle/admin/orcl1/udump/orcl1_ora_16187632.trc:
ORA-00704: bootstrap process failure
ORA-00704: bootstrap process failure
ORA-00600: internal error code, arguments: [4000], [9], [], [], [], [], [], []
Wed Jan 28 18:17:08 2026
Error 704 happened during db open, shutting down database
USER: terminating instance due to error 704
Instance terminated by USER, pid = 16187632
ORA-1092 signalled during: alter database open...

ORA-600 4000这个是在10g版本中非常常见的一个错误,一般是由于对应的block上面有事务没有提交或者scn过大导致,跟踪数据库启动过程发现在以下sql语句报错,而且报错为file 1 block 27527

EXEC #2:c=0,e=62,p=0,cr=0,cu=0,mis=0,r=0,dep=1,og=4,tim=437860213380
WAIT #2: nam='db file sequential read' ela= 139 file#=1 block#=27527 blocks=1 obj#=-1 tim=437860213555
*** 2026-01-31 15:31:40.417
ksedmp: internal or fatal error
ORA-00600: internal error code, arguments: [4000], [9], [], [], [], [], [], []
Current SQL statement for this session:
select rowcnt,blkcnt,empcnt,avgspc,chncnt,avgrln,nvl(degree,1), nvl(instances,1) from tab$ where obj# = :1

这里可以获取到两个有效信息:
1. 报错block为:file 1 block 27227
2. 报错sql为:select rowcnt,blkcnt,empcnt,avgspc,chncnt,avgrln,nvl(degree,1), nvl(instances,1) from tab$ where obj# = :1

进一步对报错数据块进行分析

Block header dump:  0x00406b87
 Object id on Block? Y
 seg/obj: 0x2  csc: 0xfe0.a99d3719  itc: 2  flg: -  typ: 1 - DATA
     fsl: 0  fnx: 0x0 ver: 0x01
 
 Itl           Xid                  Uba         Flag  Lck        Scn/Fsc
0x01   0x000b.014.00f1bb09  0x008027a5.eada.0e  C---    0  scn 0x0fda.f353b198
0x02   0x0009.01e.00212e2a  0x01400cdf.113e.01  --U-    1  fsc 0x0000.a99d371b

这里可以确认几个有效信息:
1. 该block的csc scn为:17457592743705
2. 一条已经提交的事务的scn为:17433059635608
3. 还有一条没有提交的事务,使用的回滚段为9,这个和我们报错的ORA-600[4000][9]这个回滚段名称匹配上

基于上述分析,我们需要确认两件事情:
1. 通过Oracle数据库异常恢复检查脚本(Oracle Database Recovery Check)脚本检查结果,确认当前是数据库的文件头scn为:17457591420434小于该block的csc scn
chk


2. itl操上面有一个锁需要提交,通过bbed工具对其进行提交,然后得出dump block信息

Block header dump:  0x00406b87
 Object id on Block? Y
 seg/obj: 0x2  csc: 0xfe0.a99d3719  itc: 2  flg: -  typ: 1 - DATA
     fsl: 0  fnx: 0x0 ver: 0x01

 Itl           Xid                  Uba         Flag  Lck        Scn/Fsc
0x01   0x000b.014.00f1bb09  0x008027a5.eada.0e  C---    0  scn 0x0fda.f353b198
0x02   0x0009.01e.00212e2a  0x01400cdf.113e.01  C---    0  scn 0x0000.a99d371b

修改好itl之后,先尝试重启库,如果不出意外应该会报ORA-600 2662类似错误(因为前面分析了csc scn大于文件头scn的问题)
2662


这里的ORA-600 2662中的4221831就是报错的rdba地址(10进制),通过dbms_utility.data_block_address_file转换

SQL> select dbms_utility.data_block_address_file(4221831) "file",
  2  dbms_utility.data_block_address_block(4221831) "block"
  3   from dual;

      file      block
---------- ----------
         1      27527

得出报错的ORA-600 2662的block就是我们之前分析和修复的itl块,通过修改该块scn或者修改数据库scn,该库均可open,后续就是安排导出数据导入新库的活

ORA-600 3716故障处理

联系:手机/微信(+86 17813235971) QQ(107644445)QQ咨询惜分飞

标题:ORA-600 3716故障处理

作者:惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]

数据库由于ORA-600 kcvent_intcic_zero_half错误导致实例重启

Reconfiguration started (old inc 8, new inc 10)
List of instances:
 1 2 (myinst: 2) 
 Nested reconfiguration detected. 
 Global Resource Directory frozen
 Communication channels reestablished
 * domain 0 valid = 1 according to instance 1 
 Master broadcasted resource hash value bitmaps
 Non-local Process blocks cleaned out
 LMS 0: 0 GCS shadows cancelled, 0 closed, 0 Xw survived
 LMS 1: 0 GCS shadows cancelled, 0 closed, 0 Xw survived
 Set master node info 
 Submitted all remote-enqueue requests
 Dwn-cvts replayed, VALBLKs dubious
 All grantable enqueues granted
Fri Jan 30 22:07:08 2026
minact-scn: Master returning as live inst:1 has inc# mismatch instinc:0 cur:10 errcnt:0
 Submitted all GCS remote-cache requests
 Fix write in gcs resources
Reconfiguration complete
Fri Jan 30 22:07:17 2026
Errors in file /u01/oracle11g/diag/rdbms/hisdb/hisdb2/trace/hisdb2_ckpt_1748.trc  (incident=228496):
ORA-00600: internal error code, arguments: [kcvent_intcic_zero_half], [], [], [], [], [], [], [], [], [], [], []
Incident details in: /u01/oracle11g/diag/rdbms/hisdb/hisdb2/incident/incdir_228496/hisdb2_ckpt_1748_i228496.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Errors in file /u01/oracle11g/diag/rdbms/hisdb/hisdb2/trace/hisdb2_ckpt_1748.trc:
ORA-00600: internal error code, arguments: [kcvent_intcic_zero_half], [], [], [], [], [], [], [], [], [], [], []
CKPT (ospid: 1748): terminating the instance due to error 469
Fri Jan 30 22:07:18 2026
ORA-1092 : opitsk aborting process
Fri Jan 30 22:07:19 2026
System state dump requested by (instance=2, osid=1748 (CKPT)), summary=[abnormal instance termination].

初步分析该错误是由于oracle bug引起,在11.2.0.4版本中比较少见,主要常见于19c版本中
kcvent_intcic_zero_half


正常情况下,实例重启即可,这个客户比较不幸,数据库重启遭遇ORA-600 3716错误

ALTER DATABASE OPEN /* db agent *//* {0:11:28647} */
This instance was first to open
Beginning crash recovery of 2 threads
 parallel recovery started with 15 processes
Started redo scan
Completed redo scan
 read 1120 KB redo, 386 data blocks need recovery
Started redo application at
 Thread 2: logseq 847, block 641786
Recovery of Online Redo Log: Thread 2 Group 3 Seq 847 Reading mem 0
  Mem# 0: +DATADISK/hisdb/onlinelog/group_3.267.1109863469
  Mem# 1: +ARCHIVEDISK/hisdb/onlinelog/group_3.261.1109863469
Completed redo application of 0.38MB
Completed crash recovery at
 Thread 2: logseq 847, block 644027, scn 20674490933
 386 data blocks read, 0 data blocks written, 1120 redo k-bytes read
ARCH: STARTING ARCH PROCESSES
Fri Jan 30 22:07:47 2026
ARC0 started with pid=53, OS id=332 
ARC0: Archival started
ARCH: STARTING ARCH PROCESSES COMPLETE
ARC0: STARTING ARCH PROCESSES
Fri Jan 30 22:07:48 2026
ARC1 started with pid=54, OS id=364 
Fri Jan 30 22:07:48 2026
ARC2 started with pid=55, OS id=366 
Fri Jan 30 22:07:48 2026
ARC3 started with pid=56, OS id=368 
ARC1: Archival started
ARC2: Archival started
ARC1: Becoming the 'no FAL' ARCH
ARC1: Becoming the 'no SRL' ARCH
ARC2: Becoming the heartbeat ARCH
Errors in file /u01/oracle11g/diag/rdbms/hisdb/hisdb2/trace/hisdb2_ora_29981.trc  (incident=240679):
ORA-00600: ??????, ??: [3716], [], [], [], [], [], [], [], [], [], [], []
Incident details in: /u01/oracle11g/diag/rdbms/hisdb/hisdb2/incident/incdir_240679/hisdb2_ora_29981_i240679.trc
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Abort recovery for domain 0
Aborting crash recovery due to error 600
Errors in file /u01/oracle11g/diag/rdbms/hisdb/hisdb2/trace/hisdb2_ora_29981.trc:
ORA-00600: ??????, ??: [3716], [], [], [], [], [], [], [], [], [], [], []
Abort recovery for domain 0
Errors in file /u01/oracle11g/diag/rdbms/hisdb/hisdb2/trace/hisdb2_ora_29981.trc:
ORA-00600: ??????, ??: [3716], [], [], [], [], [], [], [], [], [], [], []
ORA-600 signalled during: ALTER DATABASE OPEN /* db agent *//* {0:11:28647} */...

接手客户故障尝试启动数据库也报ORA-600 3716错误

SQL> startup
ORACLE instance started.

Total System Global Area 2.0176E+10 bytes
Fixed Size                  2261928 bytes
Variable Size            3288337496 bytes
Database Buffers         1.6844E+10 bytes
Redo Buffers               41463808 bytes
Database mounted.
ORA-00600: internal error code, arguments: [3716], [], [], []

根据官方描述该问题
open


那解决该问题相对比较简单

SQL>@rectl.sql

Control file created.
SQL> recover database;
Media recovery complete.
SQL> alter database open;

Database altered.

完美恢复这次故障,实现数据0丢失,业务直接使用

不当恢复truncate数据导致数据库不能open处理

联系:手机/微信(+86 17813235971) QQ(107644445)QQ咨询惜分飞

标题:不当恢复truncate数据导致数据库不能open处理

作者:惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]

有客户误truncate操作干掉了数据库中的几张表,然后尝试通过FY_Recover_Data进行恢复,恢复到一半然后终止了,数据库结果就起不来了(具体什么原因不知道,肯定是各种不合适的操作引起的故障),我接手故障的时候,数据库被强制resetlogs,报ORA-600 2662错误

Fri Jan 30 10:24:16 2026
alter database open resetlogs
RESETLOGS is being done without consistancy checks. This may result
in a corrupted database. The database should be recreated.
RESETLOGS after incomplete recovery UNTIL CHANGE 49708968810
Clearing online redo logfile 1 /u01/oracle/oradata/orcl/redo01.log
Clearing online log 1 of thread 1 sequence number 1069648
Clearing online redo logfile 1 complete
Clearing online redo logfile 2 /u01/oracle/oradata/orcl/redo02.log
Clearing online log 2 of thread 1 sequence number 1069649
Clearing online redo logfile 2 complete
Clearing online redo logfile 3 /u01/oracle/oradata/orcl/redo03.log
Clearing online log 3 of thread 1 sequence number 1069647
Clearing online redo logfile 3 complete
Resetting resetlogs activation ID 1738690566 (0x67a25006)
Online log /u01/oracle/oradata/orcl/redo01.log: Thread 1 Group 1 was previously cleared
Online log /u01/oracle/oradata/orcl/redo02.log: Thread 1 Group 2 was previously cleared
Online log /u01/oracle/oradata/orcl/redo03.log: Thread 1 Group 3 was previously cleared
Fri Jan 30 10:24:17 2026
Setting recovery target incarnation to 3
Fri Jan 30 10:24:17 2026
Assigning activation ID 1751706121 (0x6868ea09)
Thread 1 opened at log sequence 1
  Current log# 1 seq# 1 mem# 0: /u01/oracle/oradata/orcl/redo01.log
Successful open of redo thread 1
MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
Fri Jan 30 10:24:17 2026
SMON: enabling cache recovery
Errors in file /u01/oracle/diag/rdbms/orcl/orcl/trace/orcl_ora_14707.trc  (incident=123363):
ORA-00600: 内部错误代码, 参数: [2662], [11], [2464328561], [11], [2464328917], [12583040], [], [], [], []
Incident details in: /u01/oracle/diag/rdbms/orcl/orcl/incident/incdir_123363/orcl_ora_14707_i123363.trc
Fri Jan 30 10:24:18 2026
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Errors in file /u01/oracle/diag/rdbms/orcl/orcl/trace/orcl_ora_14707.trc:
ORA-00600: 内部错误代码, 参数: [2662], [11], [2464328561], [11], [2464328917], [12583040], [], [], [], []
Errors in file /u01/oracle/diag/rdbms/orcl/orcl/trace/orcl_ora_14707.trc:
ORA-00600: 内部错误代码, 参数: [2662], [11], [2464328561], [11], [2464328917], [12583040], [], [], [], []
Error 600 happened during db open, shutting down database
USER (ospid: 14707): terminating the instance due to error 600
Instance terminated by USER, pid = 14707
ORA-1092 signalled during: alter database open resetlogs...
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Errors in file /u01/oracle/diag/rdbms/orcl/orcl/trace/orcl_ora_14707.trc:
ORA-00600: 内部错误代码, 参数: [2662], [11], [2464328564], [11], [2464328917], [12583040], [], [], [], []
ORA-00600: 内部错误代码, 参数: [2662], [11], [2464328563], [11], [2464328917], [12583040], [], [], [], []
ORA-01092: ORACLE 实例终止。强制断开连接
ORA-00600: 内部错误代码, 参数: [2662], [11], [2464328561], [11], [2464328917], [12583040], [], [], [], []
Errors in file /u01/oracle/diag/rdbms/orcl/orcl/trace/orcl_ora_14707.trc:
ORA-27300: 操作系统系统相关操作: semctl 失败, 状态为: 22
ORA-27301: 操作系统故障消息: Invalid argument
ORA-27302: 错误发生在: sskgpwpost1
ORA-27303: 附加信息: semid = 32779
ORA-00600: 内部错误代码, 参数: [2662], [11], [2464328564], [11], [2464328917], [12583040], [], [], [], []
ORA-00600: 内部错误代码, 参数: [2662], [11], [2464328563], [11], [2464328917], [12583040], [], [], [], []
ORA-01092: ORACLE 实例终止。强制断开连接
ORA-00603: ORACLE server session terminated by fatal error
ORA-00600: internal error code, arguments: [2662], [11], [2464328564], [11], [2464328917], [12583040], []
ORA-00600: internal error code, arguments: [2662], [11], [2464328563], [11], [2464328917], [12583040], []
ORA-01092: ORACLE instance terminated. Disconnection forced
ORA-00600: internal error code, arguments: [2662], [11], [2464328561], [11], [2464328917], [12583040], []

通过Oracle数据库异常恢复检查脚本(Oracle Database Recovery Check)脚本检查发现有文件被offline,且resetlogs 信息不对
resetlogs


通过obet工具(Oracle数据块编辑工具( Oracle Block Editor Tool)-obet)对resetlogs相关信息进行修改

OBET> set mode edit
mode set to: edit

OBET> set file 18
filename set to: /tmp/FY_RST_DATA.DAT (file#18)

OBET> copy resetlogscn file 1 to file 18

Confirm Modify resetlogscn:
Source: file#1 (/u01/oracle/oradata/orcl/system01.dbf)
Target: file#18 (/tmp/FY_RST_DATA.DAT)
Proceed? (Y/YES to confirm): y
Successfully copied resetlog SCN information from file#1 to file#18.

OBET> copy chkscn file 1 to file 18

Confirm Modify chkscn:
Source: file#1 (/u01/oracle/oradata/orcl/system01.dbf)
Target: file#18 (/tmp/FY_RST_DATA.DAT)
Proceed? (Y/YES to confirm): y
Successfully copied checkpoint SCN information from file#1 to file#18.

OBET> sum
Check value for File /tmp/FY_RST_DATA.DAT, Block 1:
current = 0xF8EA, required = 0xFCEA

OBET> sum check
Warning: Unknown option 'check', ignored
Check value for File /tmp/FY_RST_DATA.DAT, Block 1:
current = 0xF8EA, required = 0xFCEA

OBET> sum apply

Confirm applying checksum:
File: /tmp/FY_RST_DATA.DAT
Block: 1
Offset in block: 16 (file offset: 0x00002010)
Original value: 0xF8EA
New value:      0xFCEA
Confirm? (Y/YES to proceed): y
Verification successful: Stored checksum matches calculated value (0xFCEA).
Checksum applied successfully.

然后尝试打开库,报ORA-600 kdourp_inorder2错误

Database Characterset is ZHS16GBK
Errors in file /u01/oracle/diag/rdbms/orcl/orcl/trace/orcl_smon_9198.trc  (incident=159324):
ORA-00600: internal error code, arguments: [kdourp_inorder2], [16], [0], [146], [108], [], [], [], [], []
Incident details in: /u01/oracle/diag/rdbms/orcl/orcl/incident/incdir_159324/orcl_smon_9198_i159324.trc
Stopping background process MMNL
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Block recovery from logseq 2, block 39 to scn 49708988852
Recovery of Online Redo Log: Thread 1 Group 2 Seq 2 Reading mem 0
  Mem# 0: /u01/oracle/oradata/orcl/redo02.log
Block recovery completed at rba 2.42.16, scn 11.2464348597
ORACLE Instance orcl (pid = 14) - Error 600 encountered while recovering transaction (14, 8) on object 14.
Errors in file /u01/oracle/diag/rdbms/orcl/orcl/trace/orcl_smon_9198.trc:
ORA-00600: internal error code, arguments: [kdourp_inorder2], [16], [0], [146], [108], [], [], [], [], []
Stopping background process MMON
Fri Jan 30 11:42:26 2026
Errors in file /u01/oracle/diag/rdbms/orcl/orcl/trace/orcl_smon_9198.trc  (incident=159325):
ORA-00600: internal error code, arguments: [kdourp_inorder2], [16], [0], [146], [108], [], [], [], [], []
Incident details in: /u01/oracle/diag/rdbms/orcl/orcl/incident/incdir_159325/orcl_smon_9198_i159325.trc
Starting background process MMON
Fri Jan 30 11:42:27 2026
MMON started with pid=49, OS id=10684
Starting background process MMNL
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Block recovery from logseq 2, block 39 to scn 49708988852
Recovery of Online Redo Log: Thread 1 Group 2 Seq 2 Reading mem 0
  Mem# 0: /u01/oracle/oradata/orcl/redo02.log
Block recovery completed at rba 2.42.16, scn 11.2464348597
ORACLE Instance orcl (pid = 14) - Error 600 encountered while recovering transaction (14, 8) on object 14.
Errors in file /u01/oracle/diag/rdbms/orcl/orcl/trace/orcl_smon_9198.trc:
ORA-00600: internal error code, arguments: [kdourp_inorder2], [16], [0], [146], [108], [], [], [], [], []

该报错比较明显是由于undo回滚段异常导致,通过屏蔽回滚段,open库成功.后续对客户truncate的表进行分析,比较悲催由于没有第一时间保护现场而且对所在表空间进行了大量写入操作,导致truncate数据恢复较少.

注意:PostgreSQL库出现readme_to_recover勒索

联系:手机/微信(+86 17813235971) QQ(107644445)QQ咨询惜分飞

标题:注意:PostgreSQL库出现readme_to_recover勒索

作者:惜分飞©版权所有[未经本人同意,不得以任何形式转载,否则有进一步追究法律责任的权利.]

以前恢复过不少mysql库被删除的勒索case,比如:
read_me_recover_tn勒索恢复
A_H_README_TO_RECOVER勒索恢复
A____Z____RECOVER____DATA勒索恢复
今天在PostgreSQL库中也简单了类似的勒索案例

[postgres@xifenfei database]$ psql 
psql (12.8)
Type "help" for help.

postgres=> \l
                                     List of databases
       Name        |  Owner   | Encoding |  Collate   |   Ctype    |   Access privileges   
-------------------+----------+----------+------------+------------+-----------------------
 ldar-test         | postgres | UTF8     | en_US.utf8 | en_US.utf8 | 
 postgres          | postgres | UTF8     | en_US.utf8 | en_US.utf8 | 
 readme_to_recover | postgres | UTF8     | en_US.utf8 | en_US.utf8 | 
 template0         | postgres | UTF8     | en_US.utf8 | en_US.utf8 | =c/postgres          +
                   |          |          |            |            | postgres=CTc/postgres
 template1         | postgres | UTF8     | en_US.utf8 | en_US.utf8 | =c/postgres          +
                   |          |          |            |            | postgres=CTc/postgres
(5 rows)

postgres=> \c readme_to_recover
You are now connected to database "readme_to_recover" as user "postgres".
readme_to_recover=> \d
         List of relations
 Schema |  Name  | Type  |  Owner   
--------+--------+-------+----------
 public | readme | table | postgres
(1 row)

readme_to_recover=> select * from readme;
                                                                                                   
                                 text_field                                              
-------------------------------------------------------------------------------------------------------
-------------------------------------------------
 All your data is backed up. You must pay 0.0051 BTC to bc1q9p333xxxxxxxxxxxxxj2z5fs27pu3u In 48 hours, 
  your data will be publicly disclosed and deleted . (more information: go to http://2info.win/psg)
 After paying send mail to us: rambler+3d2l7@onionmail.org and we will provide a link for 
   you to download your data. Your DBCODE is: xxxxx
(2 rows)

readme_to_recover=> select oid,relname from pg_class;
   oid   |                    relname                    
---------+-----------------------------------------------
 2196735 | readme
    2619 | pg_statistic
    1247 | pg_type
    4159 | pg_toast_2600
    4160 | pg_toast_2600_index
    2830 | pg_toast_2604
    2831 | pg_toast_2604_index
    4161 | pg_toast_3456
    4162 | pg_toast_3456_index
    2832 | pg_toast_2606
    2833 | pg_toast_2606_index
………………
   13373 | _pg_foreign_tables
   13377 | foreign_table_options
   13383 | _pg_user_mappings
   13391 | user_mappings
   13387 | user_mapping_options
(396 rows)

根据这里的readme的oid值,初步怀疑是drop所有业务表,然后创建了readme表,并且插入了勒索信息.

我做的各种数据库恢复比较多,说实话一直对pg这个特点非常不满意:
1. pg的数据存储本身依赖文件系统,通过oid(来表示库,表示表以及其他各种对象,和很多商业化数据库不一样,对于文件系统过于依赖,这样的情况如果发生了drop/truncate表等操作,表从文件系统中被删除,恢复难度较大
2. pg的表对应本身没有在每个数据块的block记录表的id信息,这样使得无法很好的进行底层基于block的扫描恢复数据,目前我知道的pdu一定的这样的功能,但是那是依赖列匹配,原则上来说对于一个稍微复杂一点的系统,这个恢复思路基本上不可行(因为列相似的数据表可能很多,导致恢复的数据过于混乱)

基于上述的两个特点,如果整个业务库被这种勒索破坏,如果没有备份,想比较好的恢复效果基本上很难(除非你运气非常好,os层面反删除恢复效果特别好,这要取决被删除的表在os上没有覆盖,文件系统元数据没有回收,系统没有识别是ssd环境等因素决定)

基于这种故障在没有备份的情况下很难恢复,那我们要做的就是:
1)有有效的备份或者容灾不被破坏;
     1> 数据需要有效的备份,有条件的建议异机或者离线
     2> 如果有条件可以部署延迟同步的备库,避免发生故障备库同步 被破坏

2)尽可能不让这种故障发生:
     1>数据库不要暴露在公网上,减少被攻击和入侵的风险
     2>数据库不要使用弱口令,减少被暴力攻破密码的风险
     3>注意应用漏洞,减少通过sql注入进行数据库进行破坏
     4>注意已知的数据库安全漏洞,防止被利用进行攻击
     5>注意操作系统安全,因为登录了数据库服务器对于数据库来说就没有安全可言