是人為shutdown,還是異常宕庫?

一、故障現象

2012年2月25日13:15:51，接到電話說某庫2個節點出現當機，13：36趕到某地,最後14：00到達6樓，之後檢視資料庫的狀況,2個節點的例項都正常,據說是異常宕庫的，到底是不是呢？來分析下！

二、處理過程

檢視資料庫的相關報警日誌和審計日誌.

資料庫alert_kf2.log日誌:

Sat Feb 25 01:17:38 2012

Shutting down instance: further logons disabled

Shutting down instance (immediate)

Sat Feb 25 01:17:59 2012

ALTER DATABASE DISMOUNT

Completed: ALTER DATABASE DISMOUNT

Sat Feb 25 01:45:14 2012

Starting ORACLE instance (force)

Sat Feb 25 01:47:57 2012

Database Characterset is ZHS16GBK

replication_dependency_tracking turned off (no async multimaster replication found)

Completed: ALTER DATABASE OPEN

資料庫alert_kf1.log日誌:

Sat Feb 25 01:22:07 2012

Shutting down instance: further logons disabled

Shutting down instance (immediate)

Sat Feb 25 01:22:22 2012

ALTER DATABASE DISMOUNT

Completed: ALTER DATABASE DISMOUNT

Sat Feb 25 01:45:14 2012

Starting ORACLE instance (force)

Sat Feb 25 01:45:14 2012

Global Enqueue Service Resources = 33288, pool = 16

Sat Feb 25 01:48:03 2012

Database Characterset is ZHS16GBK

replication_dependency_tracking turned off (no async multimaster replication found)

Completed: ALTER DATABASE OPEN

在節點kf1上的審計日誌:

$ cat ora_1753524.aud

Sat Feb 25 01:22:07 2012

ACTION : 'CONNECT'

DATABASE USER: '/'

PRIVILEGE : SYSDBA

CLIENT USER: oracle

CLIENT TERMINAL:

STATUS: 0

Sat Feb 25 01:22:22 2012

ACTION : 'SHUTDOWN'

DATABASE USER: '/'

PRIVILEGE : SYSDBA

CLIENT USER: oracle

CLIENT TERMINAL:

STATUS: 0

$ cat ora_1744902.aud

Instance name: kf1

Redo thread mounted by this instance: 0

Oracle process number: 0

1744902

Sat Feb 25 01:45:14 2012

ACTION : 'CONNECT'

DATABASE USER: '/'

PRIVILEGE : SYSDBA

CLIENT USER: oracle

CLIENT TERMINAL: Not Available

STATUS: 0

Sat Feb 25 01:45:14 2012

ACTION : 'STARTUP'

DATABASE USER: '/'

PRIVILEGE : SYSDBA

CLIENT USER: oracle

CLIENT TERMINAL: Not Available

STATUS: 0

在節點kf2上的審計日誌:

$ more ora_2740690.aud

Instance name: kf2

Sat Feb 25 01:17:38 2012

ACTION : 'CONNECT'

DATABASE USER: '/'

PRIVILEGE : SYSDBA

CLIENT USER: oracle

CLIENT TERMINAL:

STATUS: 0

Sat Feb 25 01:17:59 2012

ACTION : 'SHUTDOWN'

DATABASE USER: '/'

PRIVILEGE : SYSDBA

CLIENT USER: oracle

CLIENT TERMINAL:

STATUS: 0

$ more ora_2601180.aud

Instance name: kf2

Redo thread mounted by this instance: 0

Oracle process number: 0

Sat Feb 25 01:45:14 2012

ACTION : 'STARTUP'

DATABASE USER: '/'

PRIVILEGE : SYSDBA

CLIENT USER: oracle

CLIENT TERMINAL: Not Available

STATUS: 0

1、 從兩個節點的後臺alert日誌及audit 日誌可以看出，在2012-02-25 01:17:38有人停了kf2例項, 01:22:07停了kf1例項, 01:45:14啟動了2個例項.
三、處理結果
在事實面前，不得不承認是他Shutdown的,哎。。。。,何必了，何苦呢！