--SYSTEM表空間不足的報警 登錄之后，查詢，發現是sys.aud$占的地方太多。 SQL> select owner, segment_name, segment_type, sum(bytes)/1024/1024 space_m    from dba_segments    where tablespace_name = 'SYSTEM'  group by owner, segment_name, segment_type having sum(bytes)/1024/1024 >= 20 order by space_m desc ;  4  5  6  7  OWNER  SEGMENT_NAME   SEGMENT_TYPE SPACE_M -------- ------------------------------- ------- SYS   AUD$       TABLE      4480 SYS   IDL_UB1$     TABLE       272 SYS   SOURCE$      TABLE       72 SYS   IDL_UB2$     TABLE       32 SYS   C_OBJ#_INTCOL#  CLUSTER      27 SYS   C_TOID_VERSION#  CLUSTER      24 6 rows selected. SQL> 查看是哪個記得比較多。 col userhost format a30 select userid, userhost, count(1) from sys.aud$  where ntimestamp# >=CAST(to_date('2014-03-01 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  group by userid, userhost having count(1) > 500 order by count(1) desc ; 再繼續找哪天比較多。 select to_char(ntimestamp#, 'YYYY-MM-DD') audit_date, count(1)  from sys.aud$  where ntimestamp# >=CAST(to_date('2014-03-01 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  and userid = 'xxxx' and userhost = 'xxxx' group by to_char(ntimestamp#, 'YYYY-MM-DD')  order by count(1) desc ; select spare1, count(1) from sys.aud$  where ntimestamp# between CAST(to_date('2014-03-10 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  and CAST(to_date('2014-03-11 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP) and userid = 'xxxx' and userhost = 'xxxx' group by spare1 ; select action#, count(1) from sys.aud$  where ntimestamp# between CAST(to_date('2014-03-10 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  and CAST(to_date('2014-03-11 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP) and userid = 'xxxx' and userhost = 'xxxx' and spare1 = 'xxxx' group by action# order by count(1) desc ; 結果如下：   ACTION#  COUNT(1) ---------- ----------     101   124043     100   124043 SQL> 其實是上次打開的audit一直沒有關閉。 關閉： SQL> noaudit session; 清空： truncate table sys.aud$; ------------------------------------------------------------------------ 實戰 ------------------------------------------------------------------------ --1,查詢表空間占用情況 select dbf.tablespace_name as tablespace_name,      dbf.totalspace as totalspace,      dbf.totalblocks as totalblocks,      dfs.freespace freespace,      dfs.freeblocks freeblocks,      (dfs.freespace / dbf.totalspace) * 100 as freeRate       from (select t.tablespace_name,      sum(t.bytes) / 1024 / 1024 totalspace,      sum(t.blocks) totalblocks      from DBA_DATA_FILES t      group by t.tablespace_name) dbf,      (select tt.tablespace_name,      sum(tt.bytes) / 1024 / 1024 freespace,      sum(tt.blocks) freeblocks      from DBA_FREE_SPACE tt      group by tt.tablespace_name) dfs      where trim(dbf.tablespace_name) = trim(dfs.tablespace_name) --2,查看哪里占的比較多 SYSTEM 為step1中查詢 tablespace_name 內容 select owner, segment_name, segment_type, sum(bytes)/1024/1024 space_m    from dba_segments    where tablespace_name = 'SYSTEM'  group by owner, segment_name, segment_type having sum(bytes)/1024/1024 >= 20 order by space_m desc --3,查看是哪個記得比較多 count(1) 越大,說明占得比較多 select userid, userhost, count(1) from sys.aud$  where ntimestamp# >=CAST(to_date('2014-03-01 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  group by userid, userhost having count(1) > 500 order by count(1) desc --4,再繼續找哪天比較多 userid userhost 為上一步查詢內容 select to_char(ntimestamp#, 'YYYY-MM-DD') audit_date, count(1)  from sys.aud$  where ntimestamp# >=CAST(to_date('2015-03-01 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  and userid = 'userid' and userhost = 'userhost' group by to_char(ntimestamp#, 'YYYY-MM-DD')  order by count(1) desc ; select spare1, count(1) from sys.aud$  where ntimestamp# between CAST(to_date('2016-03-10 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  and CAST(to_date('2016-12-11 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP) and userid = 'userid' and userhost = 'userhost' group by spare1 ; --spare1 為上一步查詢內容 select action#, count(1) from sys.aud$  where ntimestamp# between CAST(to_date('2016-03-10 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  and CAST(to_date('2016-12-11 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP) and userid = 'userid' and userhost = 'userhost' and spare1 = 'Administrator' group by action# order by count(1) desc --5,關閉seeion noaudit session; --6,清空： truncate table sys.aud$;