Detect and Prevent SHUTDOWN ABORT

Hello all,
Is there any way to pre-detect the database when (for some reason) it is about to shutdown with the abort option?
My concern, is whether there exist any way that can be used to notify the user (even the sysdba) that such event happened

Hello back,
This is what I've found the day the db went down, and the trigger was not fired
Wed Jul 27 04:32:38 2011
Errors in file d:\oracle\admin\db_name\bdump\db_name_lgwr_1988.trc:
ORA-00345: redo log write error block 180877 count 2
ORA-00312: online log 1 thread 1: 'D:\ORACLE\ORADATA\db_name\REDO01.LOG'
ORA-27072: skgfdisp: I/O error
OSD-04008: WriteFile() failure, unable to write to file
O/S-Error: (OS 33) The process cannot access the file because another process has locked a portion of the file.
Wed Jul 27 04:32:40 2011
Errors in file d:\oracle\admin\db_name\bdump\db_name_lgwr_1988.trc:
ORA-00340: IO error processing online log 1 of thread 1
ORA-00345: redo log write error block 180877 count 2
ORA-00312: online log 1 thread 1: 'D:\ORACLE\ORADATA\db_name\REDO01.LOG'
ORA-27072: skgfdisp: I/O error
OSD-04008: WriteFile() failure, unable to write to file
O/S-Error: (OS 33) The process cannot access the file because another process has locked a portion of the file.
LGWR: terminating instance due to error 340
Wed Jul 27 04:32:43 2011
Errors in file d:\oracle\admin\db_name\bdump\db_name_pmon_7312.trc:
ORA-00340: IO error processing online log of threadI do not know what the real reason could be.
I just thought, that "ringing a bell" when the db goes down would have been a solution while looking at the source
cousing the error.

Similar Messages

How to to detect and prevent hidden objects in AD

in a Delegated OU, if OU owner removes the permission of Domain Admins and sets a Deny permission for Domain Admins, he can create hidden sub-ous, which are not visible for Domain administrators. How to detect those and prevent ?

If you can't trust someone, don't give them the permissions. Part of the delegation of control of anything, not just Directory Services is the reliance on the ability to manage there work space responsibly. You can't stop someone from setting
the permissions as you state other than to not give them the ability to change the permissions on the root object itself, which can be easily done and is what we do. Not because we don't trust them, but we try to prevent someone from hurting themselves
accidentally.
So just go to the OU in question and change the permissions on the parent only and take away full control. As a matter of I would recommend that you remove all rights with the exception of read. Just grant full control to all siblings of the
OU.
Paul Bergson
MVP - Directory Services
MCITP: Enterprise Administrator
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, Vista, 2003, 2000 (Early Achiever), NT4
Twitter @pbbergs
http://blogs.dirteam.com/blogs/paulbergson
Please no e-mails, any questions should be posted in the NewsGroup. This posting is provided "AS IS" with no warranties, and confers no rights.

Database is hang during shutdown abort (Urgent Production Issue)

Hi Gurus
In my production system while shutdown immediate , database was hang.
When we logged in system and gave shutdown abort its again hang.
Pls suggest me what could be the reason and how it can be solved
Thanks

Tue Oct 21 05:01:09 2008
Shutting down instance: further logons disabled
Tue Oct 21 05:45:19 2008
ksvcreate: Process(q005) creation failed
Tue Oct 21 05:45:30 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:45:42 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:45:54 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:46:06 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:46:18 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:46:30 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:46:42 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:46:54 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:47:06 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:47:18 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:47:30 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:47:42 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:47:54 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:48:06 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:48:18 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:48:30 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:48:42 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:48:54 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:49:06 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:49:18 2008
ksvcreate: Process(q000) creation failed
Tue Oct 21 05:49:24 2008
Shutting down instance (abort)
License high water mark = 26
Termination issued to instance processes. Waiting for the processes to exit
Tue Oct 21 05:49:35 2008
Instance termination failed to kill one or more processes
Tue Oct 21 06:06:43 2008
Instance terminated by USER, pid = 20613

Loss of all controlfile,database is automatic shutdown abort?

Your database is configured in NOARCHIVELOG mode. All the control files have been lost due to a hard disk failure but the data files are not lost. You have the closed whole database backup available to you. Which two statements are true in this scenario? (Choose two.)
A) The instance aborts.
B) The database cannot be recovered.
C) The database can be recovered by restoring the control files from the backup.
D) The database remains opened and you have to shut it down with the ABORT option.
E) The database can be restored till the point of the last closed whole database backup.
noarchivelog mode , before open database i had rman backup full database;
idle> conn / as sysdba
Connected.
idle> alter database open;
Database altered.
idle> conn anbob/anbob
Connected.
anbob@ANBOB> create table testdelctl(id int);
Table created.
anbob@ANBOB> insert into testdelctl values(999);
1 row created.
anbob@ANBOB> commit;
Commit complete.
anbob@ANBOB> conn system/oracle
Connected.
system@ANBOB> select * from v$controlfile;
STATUS
NAME
IS_ BLOCK_SIZE FILE_SIZE_BLKS
/oracle/oradata/anbob/control01.ctl
NO 16384 430
/oracle/oradata/anbob/control02.ctl
NO 16384 430
/oracle/oradata/anbob/control03.ctl
NO 16384 430
system@ANBOB> !rm /oracle/oradata/anbob/control*.ctl
system@ANBOB> !ls /oracle/oradata/anbob/
redo01.log redo03.log system01.dbf undotbs01.dbf users01.dbf
redo02.log sysaux01.dbf temp01.dbf undotbs2.dbf
system@ANBOB> select open_mode from v$database;
select open_mode from v$database
ERROR at line 1:
ORA-00210: cannot open the specified control file
ORA-00202: control file: '/oracle/oradata/anbob/control01.ctl'
ORA-27041: unable to open file
Linux Error: 2: No such file or directory
Additional information: 3
system@ANBOB> select status from v$instance;
STATUS
OPEN
sys@ANBOB> conn anbob/anbob
Connected.
anbob@ANBOB> select * from testdelctl;
ID
999
anbob@ANBOB> insert into testdelctl values(0);
1 row created.
anbob@ANBOB> commit;
Commit complete.
anbob@ANBOB> conn / as sysdba
Connected.
sys@ANBOB> alter systme checkpoint;
alter systme checkpoint
ERROR at line 1:
ORA-00940: invalid ALTER command
sys@ANBOB> alter system checkpoint;
System altered.
sys@ANBOB> select status from v$instance;
STATUS
OPEN
sys@ANBOB> select * from v$version where rownum=1
2 ;
BANNER
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod
sys@ANBOB> shutdown immediate
ORA-00210: cannot open the specified control file
ORA-00202: control file: '/oracle/oradata/anbob/control01.ctl'
ORA-27041: unable to open file
Linux Error: 2: No such file or directory
Additional information: 3
sys@ANBOB> shutdown abort
ORACLE instance shut down.
sys@ANBOB> startup
ORACLE instance started.
Total System Global Area 167772160 bytes
Fixed Size 1218316 bytes
Variable Size 96471284 bytes
Database Buffers 67108864 bytes
Redo Buffers 2973696 bytes
ORA-00205: error in identifying control file, check alert log for more info
sys@ANBOB> select status from v$instance;
STATUS
STARTED
[oracle@aix ~]$ rman target/
Recovery Manager: Release 10.2.0.1.0 - Production on Thu Jul 14 22:32:12 2011
Copyright (c) 1982, 2005, Oracle. All rights reserved.
connected to target database: anbob (not mounted)
RMAN> restore controlfile;
Starting restore at 14-JUL-11
using target database control file instead of recovery catalog
allocated channel: ORA_DISK_1
channel ORA_DISK_1: sid=156 devtype=DISK
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of restore command at 07/14/2011 22:32:27
RMAN-06563: control file or SPFILE must be restored using FROM AUTOBACKUP
RMAN> restore controlfile from autobackup;
Starting restore at 14-JUL-11
using channel ORA_DISK_1
recovery area destination: /oracle/flash_recovery_area
database name (or database unique name) used for search: ANBOB
channel ORA_DISK_1: autobackup found in the recovery area
channel ORA_DISK_1: autobackup found: /oracle/flash_recovery_area/ANBOB/autobackup/2011_07_14/o1_mf_s_756511643_71xy4xjm_.bkp
channel ORA_DISK_1: control file restore from autobackup complete
output filename=/oracle/oradata/anbob/control01.ctl
output filename=/oracle/oradata/anbob/control02.ctl
output filename=/oracle/oradata/anbob/control03.ctl
Finished restore at 14-JUL-11
RMAN> alter database open;
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of alter db command at 07/14/2011 22:32:52
ORA-01507: database not mounted
RMAN> alter database mount;
database mounted
released channel: ORA_DISK_1
RMAN> alter database open;
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of alter db command at 07/14/2011 22:33:12
ORA-01589: must use RESETLOGS or NORESETLOGS option for database open
RMAN> alter database open resetlogs;
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of alter db command at 07/14/2011 22:33:19
ORA-01194: file 1 needs more recovery to be consistent
ORA-01110: data file 1: '/oracle/oradata/anbob/system01.dbf'
RMAN> recover database;
Starting recover at 14-JUL-11
Starting implicit crosscheck backup at 14-JUL-11
allocated channel: ORA_DISK_1
channel ORA_DISK_1: sid=156 devtype=DISK
Crosschecked 3 objects
Finished implicit crosscheck backup at 14-JUL-11
Starting implicit crosscheck copy at 14-JUL-11
using channel ORA_DISK_1
Finished implicit crosscheck copy at 14-JUL-11
searching for all files in the recovery area
cataloging files...
cataloging done
List of Cataloged Files
=======================
File Name: /oracle/flash_recovery_area/ANBOB/autobackup/2011_07_14/o1_mf_s_756511643_71xy4xjm_.bkp
using channel ORA_DISK_1
starting media recovery
archive log thread 1 sequence 19 is already on disk as file /oracle/oradata/anbob/redo03.log
archive log thread 1 sequence 20 is already on disk as file /oracle/oradata/anbob/redo01.log
archive log filename=/oracle/oradata/anbob/redo03.log thread=1 sequence=19
archive log filename=/oracle/oradata/anbob/redo01.log thread=1 sequence=20
media recovery complete, elapsed time: 00:00:03
Finished recover at 14-JUL-11
RMAN> alter database open resetlogs;
database opened
RMAN> exit
Recovery Manager complete.
o[oracle@aix ~]$ ora
SQL*Plus: Release 10.2.0.1.0 - Production on Thu Jul 14 22:34:23 2011
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
sys@ANBOB> !ls /oracle/oradata/anbob/
control01.ctl control03.ctl redo02.log sysaux01.dbf temp01.dbf undotbs2.dbf
control02.ctl redo01.log redo03.log system01.dbf undotbs01.dbf users01.dbfconn anbob
sys@ANBOB> conn anbob
Enter password:
Connected.
anbob@ANBOB> select * from tab;
TNAME TABTYPE CLUSTERID
TESTCHAR TABLE
TT TABLE
TESTTRUN TABLE
TESTADDM TABLE
TEST TABLE
TESTFUNIDX TABLE
TEAM TABLE
MEMB TABLE
TESTENC TABLE
TESTREC TABLE
BIN$p/SuvHy7sn7gQKjA9QF/dQ==$0 TABLE
DETP TABLE
TESTDELCTL TABLE
DEPT TABLE
TESTFLS TABLE
15 rows selected.
anbob@ANBOB> select * from testdelctl;
ID
999
0
why,loss of all controlfile,the database not abort?

Satish Kandi wrote:
The files, which are in use by a process, are not actually deleted when one issues rm command.
Its only when the process terminates that the locks are released and file is actually deleted at operating system level.I concur!
This behavior is *NIX only.
Windows explicitly prevents open files from being deleted.
Edited by: sb92075 on Jul 14, 2011 9:18 PM

Can a "shutdown abort" cause a fractured block?

Hey there, simple question: Can a "shutdown abort" cause a fractured block?
I'm currently doing some postmortem work on an old DB (EBS R12 OBA) installation and what might lead to a fractured block. It appears that once a fractured block is detected, Oracle Support automatically shuffles the issue off as a "serious issue within the OS/HW layer". I suppose as a DBA this means they can wash their hands of the issue and pass it on to someone else.
So far it appears that an OS level app could compromise the write of logical blocks to OS blocks. It also appears that logical volume configuration (pertaining to an older AIX install) could lead to fractured blocks. Yet another article indicates that an HBA I/O error could lead to this issue. And of course file-system corruption.
But...going back to the original question, can a shutdown abort on a database introduce a fractured block?

It cannot. A shutdown abort or any abnormal termination means that active transactions are terminated without COMMIT or ROLLBACK. When you start the database after a SHUTDOWN ABORT or any other abnormal termination, Oracle says the active transactions failed and rolls them back. You will be left with the database in a consistent state as if those active transactions never occurred. I suppose you could say that until recovery is complete the block could be in a fractured state meaning that the contents could be inconsistent. But once the database is opened, the block is consistent and not fractured.
HTH,
Brian

Shutdown abort during switch over?

Hello,
I seem to notice a different behaviour between 11.2.0.1 and 11.2.0.2 during switchover on Linux 64 bit.
On primary I'm connected in sqlplus
ALTER DATABASE COMMIT TO SWITCHOVER TO PHYSICAL STANDBY;
Database altered.
exit
In alert.log:
Fri Dec 03 11:52:50 2010
Process (ospid 15296) is suspended due to switchover to physical standby operation.
Enter again in sqlplus
SQL> SHUTDOWN IMMEDIATE;
ORA-01092: ORACLE instance terminated. Disconnection forced
in alert.log
Fri Dec 03 11:53:23 2010
Performing implicit shutdown abort due to switchover to physical standby
Shutting down instance (abort)
License high water mark = 811
USER (ospid: 16022): terminating the instance
Instance terminated by USER, pid = 16022
Fri Dec 03 11:53:25 2010
Instance shutdown complete
ORA-1092 : opitsk aborting process
remaining inside sql session:
SQL> STARTUP MOUNT;
ORA-24324: service handle not initialized
ORA-01041: internal error. hostdef extension doesn't exist
exit and restart sqlplus
SQL> STARTUP MOUNT;
ORACLE instance started.
Total System Global Area 2739171328 bytes
Fixed Size          2229640 bytes
Variable Size          1207962232 bytes
Database Buffers     1509949440 bytes
Redo Buffers          19030016 bytes
in alert.log
Fri Dec 03 11:55:02 2010
Starting ORACLE instance (normal)
****************** Huge Pages Information *****************
Huge Pages memory pool detected (total: 1500 free: 1500)
DFLT Huge Pages allocation successful (allocated: 1313)
And then normal election to primary for the dr RDBMS.
But I didn't notice this "shutdown abort" when using 11.2.0.1.
The same happens if at the beginning I remain in sqlplus sesison and try to run "startup mount"
Is this expected?
Thanks in advance,
Gianluca

If you use IMMEDIATE, an ABORT will be performed anyway as of 11.2.0.2 and you would see the following in the alert
Performing implicit shutdown abort due to switchover to physical standby
Shutting down instance (abort)
So the answer is Yes.
You can confirm this yourself by reviewing :
11.2 Data Guard Physical Standby Switchover Best Practices using SQL*Plus [ID 1304939.1]
Best Regards
mseberg
Wow, this question is way old! Please open your own question user user11311455, you caught me before I had coffee.
Edited by: mseberg on Aug 17, 2011 8:09 AM

SHUTDOWN ABORT in ORACLE 10g

Hi,
I wrote a procedure to be run before reinstalling a database. As I am not interested in rolling back, or waiting for transactions to finish, I am using SHUTDOWN ABORT to drop users. Everything works well in ORACLE 9i but it cannot restart in 10g - error:
ORA-12514: TNS:listener does not currently know of service requested in connect
descriptor.
The procedure looks like:
SHUTDOWN ABORT
STARTUP RESTRICT
declare
cursor cnt_usr is
Select username from dba_users where username in (....some user names);
str_cmd varchar2(400):='';
begin
FOR usr IN cnt_usr LOOP
BEGIN
str_cmd := 'DROP USER '|| usr.username || ' CASCADE ' ;
dbms_output.put_line ('Executing: '|| str_cmd);
EXECUTE IMMEDIATE str_cmd;
EXCEPTION
WHEN OTHERS THEN str_cmd := ' ';
END;
END LOOP;
end;
ALTER SYSTEM DISABLE RESTRICTED SESSION;
exit;
Any idea what may cause the error?
Thank you
Dan

> You do know that Abort means to kill the database.
Incorrect. It simply means that the database is shutdown in an inconsistent state - i.e. with "open" transactions and thus "dirty" data.
However, Oracle is designed as a very robust database and this is not a problem. It simply gets the database into a consistent state again on the next startup.
The risk is that something or someone interferes (mucks up) Oracle data files before the next db start - without the redo logs for example, the instance will have a hard time trying to recover the database and get it into a consistent state.
The danger is thus not Oracle, but the Idiot Factor one tends to get with cowboy-type administrators.
What is questionable though is the OP's script that requires the database to be shutdown and started up for a series of drop schemas. That is using a Very Large Hammer to drive in a Very Small Nail. It is a total overkill - not too mention impacting database availability.. And I do not think that our environment is so special/unique that it the exception to measure Oracle instance uptime in 1000's of hours.

What is the best malwear detection and protection for use on a Mac?

What is the best malwear detection and protection for use on a Mac?

Mac users often ask whether they should install "anti-virus" software. The answer usually given on ASC is "no." The answer is right, but it may give the wrong impression that there is no threat from what are loosely called "viruses." There is a threat, and you need to educate yourself about it.
1. This is a comment on what you should—and should not—do to protect yourself from malicious software ("malware") that circulates on the Internet and gets onto a computer as an unintended consequence of the user's actions. It does not apply to software, such as keystroke loggers, that may be installed deliberately by an intruder who has hands-on access to the computer, or who has been able to log in to it remotely. That threat is in a different category, and there's no easy way to defend against it.
The comment is long because the issue is complex. The key points are in sections 5, 6, and 10.
OS X now implements three layers of built-in protection specifically against malware, not counting runtime protections such as execute disable, sandboxing, system library randomization, and address space layout randomization that may also guard against other kinds of exploits.
2. All versions of OS X since 10.6.7 have been able to detect known Mac malware in downloaded files, and to block insecure web plugins. This feature is transparent to the user. Internally Apple calls it "XProtect."
The malware recognition database used by XProtect is automatically updated; however, you shouldn't rely on it, because the attackers are always at least a day ahead of the defenders.
The following caveats apply to XProtect:
☞ It can be bypassed by some third-party networking software, such as BitTorrent clients and Java applets.
☞ It only applies to software downloaded from the network. Software installed from a CD or other media is not checked.
As new versions of OS X are released, it's not clear whether Apple will indefinitely continue to maintain the XProtect database of older versions such as 10.6. The security of obsolete system versions may eventually be degraded. Security updates to the code of obsolete systems will stop being released at some point, and that may leave them open to other kinds of attack besides malware.
3. Starting with OS X 10.7.5, there has been a second layer of built-in malware protection, designated "Gatekeeper" by Apple. By default, applications and Installer packages downloaded from the network will only run if they're digitally signed by a developer with a certificate issued by Apple. Software certified in this way hasn't necessarily been tested by Apple, but you can be reasonably sure that it hasn't been modified by anyone other than the developer. His identity is known to Apple, so he could be held legally responsible if he distributed malware. That may not mean much if the developer lives in a country with a weak legal system (see below.)
Gatekeeper doesn't depend on a database of known malware. It has, however, the same limitations as XProtect, and in addition the following:
☞ It can easily be disabled or overridden by the user.
☞ A malware attacker could get control of a code-signing certificate under false pretenses, or could simply ignore the consequences of distributing codesigned malware.
☞ An App Store developer could find a way to bypass Apple's oversight, or the oversight could fail due to human error.
Apple has so far failed to revoke the codesigning certificates of some known abusers, thereby diluting the value of Gatekeeper and the Developer ID program. These failures don't involve App Store products, however.
For the reasons given, App Store products, and—to a lesser extent—other applications recognized by Gatekeeper as signed, are safer than others, but they can't be considered absolutely safe. "Sandboxed" applications may prompt for access to private data, such as your contacts, or for access to the network. Think before granting that access. Sandbox security is based on user input. Never click through any request for authorization without thinking.
4. Starting with OS X 10.8.3, a third layer of protection has been added: a "Malware Removal Tool" (MRT). MRT runs automatically in the background when you update the OS. It checks for, and removes, malware that may have evaded the other protections via a Java exploit (see below.) MRT also runs when you install or update the Apple-supplied Java runtime (but not the Oracle runtime.) Like XProtect, MRT is effective against known threats, but not against unknown ones. It notifies you if it finds malware, but otherwise there's no user interface to MRT.
5. The built-in security features of OS X reduce the risk of malware attack, but they are not, and never will be, complete protection. Malware is foremost a problem of human behavior, and no technological fix alone is going to solve it. Trusting software to protect you will only make you more vulnerable.
The best defense is always going to be your own intelligence. With the possible exception of Java exploits, all known malware circulating on the Internet that affects a fully-updated installation of OS X 10.6 or later takes the form of so-called "Trojan horses," which can only have an effect if the victim is duped into running them. The threat therefore amounts to a battle of wits between you and Internet criminals. If you're better informed than they think you are, you'll win. That means, in practice, that you always stay within a safe harbor of computing practices. How do you know when you're leaving the safe harbor? Below are some warning signs of danger.
Software from an untrustworthy source
☞ Software of any kind is distributed via BitTorrent, or Usenet, or on a website that also distributes pirated music or movies.
☞ Software with a corporate brand, such as Adobe Flash Player, doesn't come directly from the developer’s website. Do not trust an alert from any website to update Flash, or your browser, or any other software.
☞ Rogue websites such as Softonic, Soft32, and CNET Download distribute free applications that have been packaged in a superfluous "installer."
☞ The software is advertised by means of spam or intrusive web ads. Any ad, on any site, that includes a direct link to a download should be ignored.
Software that is plainly illegal or does something illegal
☞ High-priced commercial software such as Photoshop is "cracked" or "free."
☞ An application helps you to infringe copyright, for instance by circumventing the copy protection on commercial software, or saving streamed media for reuse without permission. All "YouTube downloaders" are in this category, though not all are necessarily malicious.
Conditional or unsolicited offers from strangers
☞ A telephone caller or a web page tells you that you have a “virus” and offers to help you remove it. (Some reputable websites did legitimately warn visitors who were infected with the "DNSChanger" malware. That exception to this rule no longer applies.)
☞ A web site offers free content such as video or music, but to use it you must install a “codec,” “plug-in,” "player," "downloader," "extractor," or “certificate” that comes from that same site, or an unknown one.
☞ You win a prize in a contest you never entered.
☞ Someone on a message board such as this one is eager to help you, but only if you download an application of his choosing.
☞ A "FREE WI-FI !!!" network advertises itself in a public place such as an airport, but is not provided by the management.
☞ Anything online that you would expect to pay for is "free."
Unexpected events
☞ A file is downloaded automatically when you visit a web page, with no other action on your part. Delete any such file without opening it.
☞ You open what you think is a document and get an alert that it's "an application downloaded from the Internet." Click Cancel and delete the file. Even if you don't get the alert, you should still delete any file that isn't what you expected it to be.
☞ An application does something you don't expect, such as asking for permission to access your contacts, your location, or the Internet for no obvious reason.
☞ Software is attached to email that you didn't request, even if it comes (or seems to come) from someone you trust.
I don't say that leaving the safe harbor just once will necessarily result in disaster, but making a habit of it will weaken your defenses against malware attack. Any of the above scenarios should, at the very least, make you uncomfortable.
6. Java on the Web (not to be confused with JavaScript, to which it's not related, despite the similarity of the names) is a weak point in the security of any system. Java is, among other things, a platform for running complex applications in a web page, on the client. That was always a bad idea, and Java's developers have proven themselves incapable of implementing it without also creating a portal for malware to enter. Past Java exploits are the closest thing there has ever been to a Windows-style virus affecting OS X. Merely loading a page with malicious Java content could be harmful.
Fortunately, client-side Java on the Web is obsolete and mostly extinct. Only a few outmoded sites still use it. Try to hasten the process of extinction by avoiding those sites, if you have a choice. Forget about playing games or other non-essential uses of Java.
Java is not included in OS X 10.7 and later. Discrete Java installers are distributed by Apple and by Oracle (the developer of Java.) Don't use either one unless you need it. Most people don't. If Java is installed, disable it—not JavaScript—in your browsers.
Regardless of version, experience has shown that Java on the Web can't be trusted. If you must use a Java applet for a task on a specific site, enable Java only for that site in Safari. Never enable Java for a public website that carries third-party advertising. Use it only on well-known, login-protected, secure websites without ads. In Safari 6 or later, you'll see a lock icon in the left side of the address bar when visiting a secure site.
Stay within the safe harbor, and you’ll be as safe from malware as you can practically be. The rest of this comment concerns what you should not do to protect yourself.
7. Never install any commercial "anti-virus" (AV) or "Internet security" products for the Mac, as they are all worse than useless. If you need to be able to detect Windows malware in your files, use one of the free security apps in the Mac App Store—nothing else.
Why shouldn't you use commercial AV products?
☞ To recognize malware, the software depends on a database of known threats, which is always at least a day out of date. This technique is a proven failure, as a major AV software vendor has admitted. Most attacks are "zero-day"—that is, previously unknown. Recognition-based AV does not defend against such attacks, and the enterprise IT industry is coming to the realization that traditional AV software is worthless.
☞ Its design is predicated on the nonexistent threat that malware may be injected at any time, anywhere in the file system. Malware is downloaded from the network; it doesn't materialize from nowhere. In order to meet that nonexistent threat, commercial AV software modifies or duplicates low-level functions of the operating system, which is a waste of resources and a common cause of instability, bugs, and poor performance.
☞ By modifying the operating system, the software may also create weaknesses that could be exploited by malware attackers.
☞ Most importantly, a false sense of security is dangerous.
8. An AV product from the App Store, such as "ClamXav," has the same drawback as the commercial suites of being always out of date, but it does not inject low-level code into the operating system. That doesn't mean it's entirely harmless. It may report email messages that have "phishing" links in the body, or Windows malware in attachments, as infected files, and offer to delete or move them. Doing so will corrupt the Mail database. The messages should be deleted from within the Mail application.
An AV app is not needed, and cannot be relied upon, for protection against OS X malware. It's useful, if at all, only for detecting Windows malware, and even for that use it's not really effective, because new Windows malware is emerging much faster than OS X malware.
Windows malware can't harm you directly (unless, of course, you use Windows.) Just don't pass it on to anyone else. A malicious attachment in email is usually easy to recognize by the name alone. An actual example:
London Terror Moovie.avi [124 spaces] Checked By Norton Antivirus.exe
You don't need software to tell you that's a Windows trojan. Software may be able to tell you which trojan it is, but who cares? In practice, there's no reason to use recognition software unless an organizational policy requires it. Windows malware is so widespread that you should assume it's in every email attachment until proven otherwise. Nevertheless, ClamXav or a similar product from the App Store may serve a purpose if it satisfies an ill-informed network administrator who says you must run some kind of AV application. It's free and it won't handicap the system.
The ClamXav developer won't try to "upsell" you to a paid version of the product. Other developers may do that. Don't be upsold. For one thing, you should not pay to protect Windows users from the consequences of their choice of computing platform. For another, a paid upgrade from a free app will probably have all the disadvantages mentioned in section 7.
9. It seems to be a common belief that the built-in Application Firewall acts as a barrier to infection, or prevents malware from functioning. It does neither. It blocks inbound connections to certain network services you're running, such as file sharing. It's disabled by default and you should leave it that way if you're behind a router on a private home or office network. Activate it only when you're on an untrusted network, for instance a public Wi-Fi hotspot, where you don't want to provide services. Disable any services you don't use in the Sharing preference pane. All are disabled by default.
10. As a Mac user, you don't have to live in fear that your computer may be infected every time you install software, read email, or visit a web page. But neither can you assume that you will always be safe from exploitation, no matter what you do. Navigating the Internet is like walking the streets of a big city. It's as safe or as dangerous as you choose to make it. The greatest harm done by security software is precisely its selling point: it makes people feel safe. They may then feel safe enough to take risks from which the software doesn't protect them. Nothing can lessen the need for safe computing practices.

How to startup database after shutdown abort

Hi.
I had a havy load transaction, coudn't kill, so I run shutdown abort,
now I can't open database, that is massage I get:
"ORA-16038: log 3 sequence# 52 cannot be archived
ORA-19809: limit exceeded for recovery files
ORA-00312: online log 3 thread 1:
'/u01/app/oracle/oradata/ORCL/onlinelog/o1_mf_3_48fpv6q1_.log'
ORA-00312: online log 3 thread 1:
'/u01/app/oracle/flash_recovery_area/ORCL/onlinelog/o1_mf_3_48fpv95v_.log'
What to do?

Upss sorry:
Check your flashrecovery area directory, it's full and your redo logs cannot be archived
release the space..
Kamran Agayev A. (10g OCP)
http://kamranagayev.wordpress.com
Edited by: Kamran Agayev A. on Mar 5, 2009 8:27 PM

Mail is preventing shutdown

Every time I try to shut down I get told that Mail is preventing shutdown, I know how to force quit but how do I prevent it from happening in the first place?

Please follow these directions to delete the Mail "sandbox" folders. In OS X 10.9 there are two sandboxes, while in 10.8 there is only one. If you're running a version older than 10.8, this comment isn't applicable.
Back up all data.
Triple-click anywhere in the line below on this page to select it:
~/Library/Containers/com.apple.mail
Right-click or control-click the highlighted line and select
Services ▹ Reveal
from the contextual menu.* A Finder window should open with a folder named "com.apple.mail" selected. If it does, move the selected folder — not just its contents — to the Desktop. Leave the Finder window open for now.
Log out and log back in. Launch Mail and test. If the problem is resolved, you may have to recreate some of your Mail settings. You can then delete the folder you moved and close the Finder window. If you still have the problem, quit Mail again and put the folder back where it was, overwriting the one that may have been created in its place. Repeat with this line:
~/Library/Containers/com.apple.MailServiceAgent
Caution: If you change any of the contents of the sandbox, but leave the folder itself in place, Mail may crash or not launch at all. Deleting the whole sandbox will cause it to be rebuilt automatically.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select
Go ▹ Go to Folder...
from the menu bar, paste into the box that opens (command-V). You won't see what you pasted because a line break is included. Press return.

ASM instance shutdown abort automatic on 10gr2 RAC

Hi all, I have a oracle 10gR2 RAC on solaris9 with three nodes.the node2 and node3 work right,but the ASM instance on node1 often shutdown abort automatic and no any erros in alertlog file.
why ?
Fri Nov 3 10:17:39 2006
Shutting down instance (abort)
License high water mark = 6
Instance terminated by USER, pid = 15327

Does anyone know ?

Hackers - What to look out for and prevention!?

Hi, I was just looking through my logs and such and saw some alot of gobbly gook. It made me nervous. so I was wondering what are the main tips on detecting a Hacker, spotting Hacking attempts and prevention of Hackers?
I understand that I depends on what kit you have and such and that your computer has to make connections with others to use the internet but what do I and every other average Apple user need to look out for in logs on modems, firewalls and applications.
I personaly have looked at my logs on my Netgear Modem and logs on my System Profiler application. I see connections to various things but i'm no good at networking. All I know is to have my firewall on!
Also...I am always nervous when using Bit Torrent, do I have any need to be?
Thanks all ~ Joe
p.s - I have also read in other posts that posting log information is a dumb idea so have played safe and kept them to myself. So there's my tip! :)
PowerBook G4 15" - Sept 04- 1.5 GHz Mac OS X (10.4.2) Power Mac G4 1GHz DP - Airport Extreme - 2MBPS Broadband

It's not always true that an invalid access is an attack. For example, if your firewall application reports that the misused source port is a high port number, it might be a trigger packet. Some ISP may configure the servers system incorrectly or insufficiently. Some organization or a group of companies may send scanning packets to P2P users in a special way in order to improve heavy WAN traffics caused by P2P software users. You might mis-configure your modem or router firewall system or a built-in firewall has a bug, etc.
If a source port number is in the rage between 49152 and 65535, it is normally either dynamic or private ports. Dynamic ports are randomly assigned, and private ports are used by OS software or applications. By seeing any high ports with other logs events, you may guess whether someone attacks your node, about his/her skills/ability and the time zone. You may see one of high ports displaying on Netstat program for Network Utility application when pressing "Display the state of all current socket connections"-- udp4 0 0 localhost.xxxxx. Netstat may help to know who is on networks but not in real time. You need to refresh the button manually.
Here are two basic points:
* It is important to know yourself and think of your computer configurations before you start thinking who is there or your enemy.
* The most important matter in computer security is to be aware, and watch the systems carefully something most people do not do. For example, check if asl.log facility status with the level integer value displays differently from regular bases. If system.log or console.log reports that your computer name and the host name are changed, you may be facing to a serious security situation.
If you want to see whether your ISP blocks ports or you have opened ports, security scan service such as grc.com (Shields UP), dshield.org or seifried.org are available on the Internet.
Mac OS X Tiger built-in firewall (ipfw) has basic features. You can add rule-sets if you want. See for example here. Normally, you do not need to change the default rule-sets that blocks unwanted incoming packets.
Here is how to read about a log example for Mac OS X built-in firewall:
ipfw: 64000 Deny TCP 123.456.78.900:4990 444.555.66.777:1433 in via en1
The ipfw rule-set 64000 denies a Transmission Control Protocol IP packet sent by the source address 123.456.78.900 via the port number 4990 to attempt an invalid access to the destination address 444.555.66.777 targeting to the port 1433 in via your interface "AirPort." The destination address in this case is your local IP address, but not a remote IP address assigned for your ISP (for instance) node. The BSD device name for Built-in Ethernet interface is "en0." "en1" is used for AirPort or the first PCI Ethernet card if you install one.
You see the Mac OS X built-in firewall do not tell you the service name of a misused port number and the host name of the source IP address in real time. Therefore, it may be uncomfortable to analyze the background in details-- especially, if events of the firewall log would be flooded by access attempted every minute or more frequently. You may not even be able to send an e-mail to abuse team who is responsible for the source IP address net block to ask for the investigation if you want to do so. To send an enquiry has two meaning-- suggesting their server vulnerability or insufficient configuration and making a good use of their reply to your analysis.
In this case, an unassigned port number 4990 is misused by someone directly or indirectly (e.g. bot, botarmy, etc.) from the server 123.456.78.900, and the port 1433 for sniffing if a Microsoft SQL Server (Windows related) is running on your machine. There is also known history that some viruses try to exploit vulnerabilities in Microsoft SQL Server. The most known ports being misused in recent days are 8 (ICMP ping) 135, 139, 445 and ports for Trojan Horses and P2P technology driven software such as BitTorrent-- See also this world map, http://isc.sans.org/.
You may think about why bad IP packets pass through your ISP servers especially if servers are configured with a firewall system.
If you want to know more about Transmission Control Protocol specification, find "RFC 793" documentation on the Internet. All assigned port numbers document is available at www.iana.org.
If you are interested in third-party firewall, DoorStop X and Who's There are very good applications. You'll see it when you use their trial version with the full features.
Good firewall applications may protect your computer from various invalid access attempts but not for the real solution. Good packet analyzing (Sniffers) applications may help to inform you a result of analysis but not for the real solution. End-users, ISPs and the authorities need to run to the same direction together.

Shutdown abort

whats the worst thing that can happen when you kill oracle procee kill -9 or do shutdown abort ?
will oracle always get away with instance recovery ?
or it could corrupt redo log?
will there be need for recovery or restore?

whats the worst thing that can happen when you kill oracle procee kill -9 or do shutdown abort ?Database will shut down in inconsistent state and in next startup it need the instance recovery which is done automatically by SMON process.
will oracle always get away with instance recovery ?
or it could corrupt redo log? What you do mean by this line? Not clear to me what you want to ask
will there be need for recovery or restore?No need to restore and recovery is required in case of instance crash.
--neeraj

ACTIVE PROCESS PREVENTS SHUTDOWN OPERATION IN ALERT LOG

Shutdown immediate seems to be hanged for few hours.............
Alert log said that...........
ACTIVE PROCESS PREVENTS SHUTDOWN OPERATION ..........
Extract of alert_log:
SHUTDOWN: Active processes prevent shutdown operation
Thu Aug 12 11:52:59 2010
SHUTDOWN: Active processes prevent shutdown operation
Thu Aug 12 11:58:00 2010
SHUTDOWN: Active processes prevent shutdown operation
Thu Aug 12 12:03:01 2010
SHUTDOWN: Active processes prevent shutdown operation
Thu Aug 12 12:08:03 2010
SHUTDOWN: Active processes prevent shutdown operation
Thu Aug 12 12:13:04 2010
SHUTDOWN: Active processes prevent shutdown operation
Thu Aug 12 12:18:05 2010
SHUTDOWN: Active processes prevent shutdown operation
Thu Aug 12 12:23:07 2010
SHUTDOWN: Active processes prevent shutdown operation
Thu Aug 12 12:28:08 2010
SHUTDOWN: Active processes prevent shutdown operation
Thu Aug 12 12:33:09 2010
SHUTDOWN: Active processes prevent shutdown operation
Thanks in advance.......
Regards,
New2DBA

Connect sqlplus "/as sysdba" then shutdown abort Refer below metalink doc
*Getting Shutdown: Active Processes Prevent Shutdown Operation [ID 780167.1]*

Running shutdown abort

When calling shutdown immediate and it lasts long
because of rolling back some transaction, I call
shutdown abort and start the instance, the crash recovery
succeeds, is there any reason for shutting down normal
again to last long too (there are no transactions to roll back)?

Hi,
any reason for shutting down normal do you mean shutdown normalWhen shutting down normal, Oracle waits for connected users to willingly disconnect (you can kill the sessions too though). Check if you've gor jobs running (DBA_JOBS_RUNNING) because they 'connect' to the database in order to run. This could be the reason why it takes a long time.
For example if I bounce one of my main DBs, once it's open, at least 5 jobs will start running. If I issue shutdown normal it'll wait for these job to finish their tasks.
Regards,
Yoann.

Detect and Prevent SHUTDOWN ABORT

Similar Messages

Maybe you are looking for