Oracle 11g Archive Log Research _3

Recording Head (record header) format:

typedefstructrh0 {uint32_t recordlen;        uint8_t VLD; //directly determines the entire record head sizeuint8_t Unknown0;    uint16_t Rhscnwrapper;    uint32_t rhscnbase; uint16_t SUBSCN;} Redo_rh0;typedefstructRh1 {uint8_t unknown1[Ten];}              Redo_rh24; //VLD = 0x01, total size 24bytetypedefstructRh5 {uint8_t unknown0[ -]; uint32_t Rhscntime;}              redo_rh68; //VLD = 0x05, total size 68byte

Redo_rh0

The record header is longer, its length is determined by VLD, and Oracle does not explicitly describe their correspondence, but fortunately most of the header's VLD are 1.

After the header is followed by a set of change items, a record may correspond to one of our operations (for example, insert), an operation is divided into a set of change (a set of operations within Oracle), each of which corresponds to an opcode (opcode). Each change is divided into a change header, a change vector table, and a change data. Format of Change header:

typedefstructOC {uint8_t layer; uint8_t Code;} Redo_oc;typedefstructCH {// -Redo_oc opcode;       uint16_t CLS; //Block classuint16_t AFN;//The file number where the data residesuint16_t OBJ0;       uint32_t DBA; //Data block address, front 10bit file number, 22bit block numberREDO_SCN SCN;        uint8_t SEQ; //Change sequenceuint8_t TYP;//Data Typeuint16_t OBJ1;} Redo_ch;

redo_ch

The length of the change head is fixed (finally a bit fixed), the first element is the operation code of this change (opcode), opcode usually starting from 5.2, 5.1, 5.4 End, the middle appears is what we do the real operation (such as 11.xx, 19.1, etc.).

The OBJ0 and OBJ1 in the change header combine to get obj:

#define getobj (Obj0, Obj1) ((uint32_t) (obj1)) | ( ((uint32_t) (obj0)) (<<16))

OBJ is the table ID for this operation, and can be used to construct SQL statements based on OBJ's query of the table name, user, field, and so on from the data dictionary.

The change header is followed by a change vector table, where the total length of the Change vector table is aligned by 4 bytes, and then its interior is every 2 bytes, and the 1th 2 bytes represent the total length of the vector table (including its own 2 bytes) (The total length before the 4-byte alignment). The length remaining after the total length (misaligned total length minus 2), divided into every 2 bytes, each segment represents the length of an element, which is written sequentially after the vector table, the length of the vector table is the true length of the element, and the elements following the vector table are written in 4-byte alignment. Parts that exceed their true length should be ignored.

The vector table is a variable-length array, each element is a unsigned short data, it should be read 2 bytes each time to parse, and the pointer from the vector table after the beginning, according to the length of the vector table to obtain the corresponding element. Gets the change element, which is the object for this change operation, for example, this change is insert, the change element is the target field and content of the insert.

Once you get to the change element, you can build the SQL statement by combining all the information that is currently taken, based on the data dictionary.

The change content is studied in detail below.

Oracle 11g Archive Log Research _3