廢話不多說(shuō)了，具體代碼如下所示：

–SYSTEM表空間不足的報(bào)警
登錄之后，查詢(xún)，發(fā)現(xiàn)是sys.aud$占的地方太多。
SQL> select owner, segment_name, segment_type, sum(bytes)/1024/1024 space_m
from dba_segments
where tablespace_name = ‘SYSTEM’
group by owner, segment_name, segment_type
having sum(bytes)/1024/1024 >= 20
order by space_m desc
;
4 5 6 7
OWNER SEGMENT_NAME SEGMENT_TYPE SPACE_M
——– ——————————- ——-
SYS AUD$ TABLE 4480
SYS IDL_UB1$ TABLE 272
SYS SOURCE$ TABLE 72
SYS IDL_UB2$ TABLE 32
SYS C_OBJ#_INTCOL# CLUSTER 27
SYS C_TOID_VERSION# CLUSTER 24
6 rows selected.
SQL>
查看是哪個(gè)記得比較多。
col userhost format a30
select userid, userhost, count(1) from sys.aud$
where ntimestamp# >=CAST(to_date(‘2014-03-01 00:00:00’, ‘YYYY-MM-DD hh24:mi:ss’) AS TIMESTAMP)
group by userid, userhost
having count(1) > 500
order by count(1) desc
;
再繼續(xù)找哪天比較多。
select to_char(ntimestamp#, ‘YYYY-MM-DD’) audit_date, count(1)
from sys.aud$
where ntimestamp# >=CAST(to_date(‘2014-03-01 00:00:00’, ‘YYYY-MM-DD hh24:mi:ss’) AS TIMESTAMP)
and userid = ‘xxxx’ and userhost = ‘xxxx’
group by to_char(ntimestamp#, ‘YYYY-MM-DD’)
order by count(1) desc
;
select spare1, count(1) from sys.aud$
where ntimestamp# between CAST(to_date(‘2014-03-10 00:00:00’, ‘YYYY-MM-DD hh24:mi:ss’) AS TIMESTAMP)
and CAST(to_date(‘2014-03-11 00:00:00’, ‘YYYY-MM-DD hh24:mi:ss’) AS TIMESTAMP)
and userid = ‘xxxx’ and userhost = ‘xxxx’
group by spare1
;
select action#, count(1) from sys.aud$
where ntimestamp# between CAST(to_date(‘2014-03-10 00:00:00’, ‘YYYY-MM-DD hh24:mi:ss’) AS TIMESTAMP)
and CAST(to_date(‘2014-03-11 00:00:00’, ‘YYYY-MM-DD hh24:mi:ss’) AS TIMESTAMP)
and userid = ‘xxxx’ and userhost = ‘xxxx’
and spare1 = ‘xxxx’
group by action#
order by count(1) desc
;
結(jié)果如下：
ACTION# COUNT(1)
———- ———-
101 124043
100 124043
SQL>
其實(shí)是上次打開(kāi)的audit一直沒(méi)有關(guān)閉。
關(guān)閉：
SQL> noaudit session;
清空：
truncate table sys.aud$;
————————————————————————
實(shí)戰(zhàn)
————————————————————————
–1,查詢(xún)表空間占用情況
select dbf.tablespace_name as tablespace_name,
dbf.totalspace as totalspace,
dbf.totalblocks as totalblocks,
dfs.freespace freespace,
dfs.freeblocks freeblocks,
(dfs.freespace / dbf.totalspace) * 100 as freeRate
from (select t.tablespace_name,
sum(t.bytes) / 1024 / 1024 totalspace,
sum(t.blocks) totalblocks
from DBA_DATA_FILES t
group by t.tablespace_name) dbf,
(select tt.tablespace_name,
sum(tt.bytes) / 1024 / 1024 freespace,
sum(tt.blocks) freeblocks
from DBA_FREE_SPACE tt
group by tt.tablespace_name) dfs
where trim(dbf.tablespace_name) = trim(dfs.tablespace_name)
–2,查看哪里占的比較多 SYSTEM 為step1中查詢(xún) tablespace_name 內(nèi)容
select owner, segment_name, segment_type, sum(bytes)/1024/1024 space_m
from dba_segments
where tablespace_name = ‘SYSTEM’
group by owner, segment_name, segment_type
having sum(bytes)/1024/1024 >= 20
order by space_m desc
–3,查看是哪個(gè)記得比較多 count(1) 越大,說(shuō)明占得比較多
select userid, userhost, count(1) from sys.aud$
where ntimestamp# >=CAST(to_date(‘2014-03-01 00:00:00’, ‘YYYY-MM-DD hh24:mi:ss’) AS TIMESTAMP)
group by userid, userhost
having count(1) > 500
order by count(1) desc
–4,再繼續(xù)找哪天比較多 userid userhost 為上一步查詢(xún)內(nèi)容
select to_char(ntimestamp#, ‘YYYY-MM-DD’) audit_date, count(1)
from sys.aud$
where ntimestamp# >=CAST(to_date(‘2015-03-01 00:00:00’, ‘YYYY-MM-DD hh24:mi:ss’) AS TIMESTAMP)
and userid = ‘userid’ and userhost = ‘userhost’
group by to_char(ntimestamp#, ‘YYYY-MM-DD’)
order by count(1) desc
;
select spare1, count(1) from sys.aud$
where ntimestamp# between CAST(to_date(‘2016-03-10 00:00:00’, ‘YYYY-MM-DD hh24:mi:ss’) AS TIMESTAMP)
and CAST(to_date(‘2016-12-11 00:00:00’, ‘YYYY-MM-DD hh24:mi:ss’) AS TIMESTAMP)
and userid = ‘userid’ and userhost = ‘userhost’
group by spare1
;
–spare1 為上一步查詢(xún)內(nèi)容
select action#, count(1) from sys.aud$
where ntimestamp# between CAST(to_date(‘2016-03-10 00:00:00’, ‘YYYY-MM-DD hh24:mi:ss’) AS TIMESTAMP)
and CAST(to_date(‘2016-12-11 00:00:00’, ‘YYYY-MM-DD hh24:mi:ss’) AS TIMESTAMP)
and userid = ‘userid’ and userhost = ‘userhost’
and spare1 = ‘Administrator’
group by action#
order by count(1) desc
–5,關(guān)閉seeion
noaudit session;
–6,清空：
truncate table sys.aud$;