【问题诊断】安全等保加固重命名SYS用户触发ORA-600[kokasgi1]错误案例分享

SQL> alter database open;
alter database open
*
ERROR at line 1:
ORA-01092: ORACLE instance terminated. Disconnection forced
ORA-00600: internal error code, arguments: [kokasgi1], [], [], [], [], [], [], [], [], [], [], []
Process ID: 4739
Session ID: 1369 Serial number: 3

SMON: enabling tx recovery
Database Characterset is ZHS16GBK
Errors in file u01/app/oracle/diag/rdbms/ywzd/ywzd/trace/ywzd_ora_4739.trc  (incident=48167):
ORA-00600: internal error code, arguments: [kokasgi1], [], [], [], [], [], [], [], [], [], [], []
Incident details in: u01/app/oracle/diag/rdbms/ywzd/ywzd/incident/incdir_48167/ywzd_ora_4739_i48167.trc
ARC3: Archival started
ARC0: STARTING ARCH PROCESSES COMPLETE
Use ADRCI or Support Workbench to package the incident.
See Note 411.1 at My Oracle Support for error and packaging details.
Errors in file u01/app/oracle/diag/rdbms/ywzd/ywzd/trace/ywzd_ora_4739.trc:
ORA-00600: internal error code, arguments: [kokasgi1], [], [], [], [], [], [], [], [], [], [], []
Errors in file u01/app/oracle/diag/rdbms/ywzd/ywzd/trace/ywzd_ora_4739.trc:
ORA-00600: internal error code, arguments: [kokasgi1], [], [], [], [], [], [], [], [], [], [], []
Error 600 happened during db open, shutting down database
USER (ospid: 4739): terminating the instance due to error 600
Instance terminated by USER, pid = 4739

SQL> shutdown immediate;
SQL> startup mount;
SQL> alter session set events='10046 trace name context forever , level 12'; 
SQL> alter database open;
alter database open
*
ERROR at line 1:
ORA-01092: ORACLE instance terminated. Disconnection forced
ORA-00600: internal error code, arguments: [kokasgi1], [], [], [], [], [], [], [], [], [], [], []
Process ID: 4739
Session ID: 1369 Serial number: 3

===================== 
select user#,password,datats#,tempts#,type#,defrole,resource$, ptime,decode(defschclass,NULL,'DEFAULT_CONSUMER_GROUP',defschclass),
spare1,spare4,ext_username,spare2 
from user$ where name=:1
END OF STMT
 Bind#0
  value="SYS"   <---绑定变量值

[oracle@YWZD-DBS ~]$ ps -ef|grep LOCAL
oracle    6961  6150  0 21:42 ?        00:00:00 oracleywzd (DESCRIPTION=(LOCAL=YES)(ADDRESS=(PROTOCOL=beq)))
[oracle@YWZD-DBS ~]$ gdb u01/app/oracle/product/11.2.0.4/dbhome_1/bin/oracle 6961
Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.212.el6_10.3.x86_64 libaio-0.3.107-10.el6.x86_64 numactl-2.0.9-2.el6.x86_64
(gdb) b kokiasg    《---- 设置断点
Breakpoint 1 at 0x15037cc
(gdb) c    《----
Continuing.

SQL> alter database open;

[oracle@YWZD-DBS ~]$ sqlplus / as sysdba
SQL*Plus: Release 11.2.0.4.0 Production on Tue Jul 26 21:45:16 2022
Copyright (c) 1982, 2013, Oracle.  All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL> select status from v$instance;
STATUS
------------
OPEN
SQL> select rowid ,name from user$ where name like 'SYS%';
ROWID           NAME
------------------ ------------------------------
AAAAAKAABAAAADRAAB SYSIDC
AAAAAKAABAAAADRAAG SYSTEM

SQL> update user$ set name='SYS' where name='SYSIDC';
1 row updated.
SQL> commit;
Commit complete.

Breakpoint 1, 0x00000000015037cc in kokiasg ()
(gdb) quit
A debugging session is active.
    Inferior 1 [process 6961] will be detached.
Quit anyway? (y or n) y
Detaching from program: /u01/app/oracle/product/11.2.0.4/dbhome_1/bin/oracle, process 6961

1、找到Oracle用户进程ID
ps -ef | grep  orcl (LOCAL=NO)


2、对上述的SPID进程号进行调试跟踪


Example: process id 3846


$ gdb $ORACLE_HOME/bin/oracle 3846
3、打印trace信息


(gdb) print ksudss(258)  --》##258为dump的level


4、找到trace文件  
cd $ORACLE_BASE/diag/rdbms/ywzd/ywzd/trace   ##参数的trace文件路径 也就是alertlog的路径
ll|grep 3846
-rw-r----- 1 oracle oinstall 6723482 Feb 4 15:51 ywzd_ora_3846.trc   ##文件名为  oraclesid_ora_pid.trc
5、退出调试窗口
(gdb) detach   ##脱离进程
(gdb) quit