数据篡改案例解析.PDFVIP

数据篡改案例解析 SQL SELECT MEMBER from v$logfile where group#=2; MEMBER /opt/oracle/oradata/mmstest/redo02.log SQL exec dbms_logmnr.add_logfile (/opt/oracle/oradata/mmstest/redo02.log,dbms_logmnr.new); PL/SQL procedure successfully completed. SQL exec dbms_logmnr.start_logmnr(options=dbms_logmnr.dict_from_online_catalog); PL/SQL procedure successfully completed. SQL select count(*) from v$logmnr_contents; COUNT(*) 136 SQL select sql_redo from v$logmnr_contents; SQL_REDO set transaction read write; insert into SYS.OBJ$(OBJ#,DATAOBJ#,OWNER#,NAME,NAMESPACE,SUBNAME,TYPE#,CTIME, MTIME,STIME,STATUS,REMOTEOWNER,LINKNAME,FLAGS,OID$,SPARE1,SPARE2,S PARE3,SPARE4,SPARE5,SPARE6) values (25847,25847,31,EYGLE,1,NULL,2, TO_DATE(01-JUL-09, DD-MON-RR),TO_DATE(01-JUL-09, DD-MON-RR),TO_DATE(01-JUL-09, DD-MON-RR),1,NULL,NULL,0,NULL,6,1,NULL,NULL,NULL,NULL); ………… create table eygle as select * from dba_users; set transaction read write; Unsupported update SYS.TSQ$ set TS# = 0, GRANTOR# = 43080, BLOCKS = 0, MAXBLOCKS = 0, PRIV1 = 0, PRIV2 = 0 where TS# = 0 and GRANTOR# = 43072 and BLOCKS = 0 and MAXBLOCKS = 0 and PRIV1 = 0 and PRIV2 = 0 173 and ROWID = AAAAAKAABAAAABbAAF; commit; set transaction read write; SQL exec dbms_logmnr.end_logmnr PL/SQL procedure successfully completed. 很多时候拿 LOGMNR 来追踪一些误操作是很有效的方式，甚至在自己定制的数据同步中，LOGMNR 也 大有可为。 案例之深入解析 对于这个案例，在技术上我们需要进一步的研究。为什么会出现不支持的情况呢？是否是 LOGMNR 的限 制导致的呢？ 根据 Oracle 的文档，LOGMNR 的确存在一定的限制，以下一些类型不被支持： 1. Simple and nested abstract datatypes (ADTs) 2. Collections (nested tables and VARRAYs) 3. Object Refs 4. Index organized