客户坚持说 只是在 每天早上5点才运行下面的语句：
select / * + FULL (TAB001_TT01) * / ‘TAB001_TT01‘, count (*) from u01.TAB001_TT01 group by ‘TAB001_TT01‘
但是根据 Incident 文件的记载，发生时间是在 2017-09-26 10: 44: 50.166 , 客户怀疑 Oracle的数据库出现了其他的问题。
这样调查就跑偏方向了。
(因为总所周知的原因，修改了敏感信息)
从下面这句“MODULE NAME”来看，通过sqlplus 进行的连接，所以一定是客户通过某个客户端作操作了。
、
*** MODULE NAME: ([email protected] (TNS V1-V3)) 2017-09-26 10: 44: 50.166
----------------------------------------------------------------------------------------------------------
*** 2017-09-26 10: 44: 50.166
*** SESSION ID: (807.42181) 2017-09-26 10: 44: 50.166
*** CLIENT ID :() 2017-09-26 10: 44: 50.166
*** SERVICE NAME: (SYS $ USERS) 2017-09-26 10: 44: 50.166
*** MODULE NAME: ([email protected] (TNS V1-V3)) 2017-09-26 10: 44: 50.166
*** CLIENT DRIVER: (SQL * PLUS) 2017-09-26 10: 44: 50.166
*** ACTION NAME :() 2017-09-26 10: 44: 50.166
TAB001_TT01
[TOC 00000]
Jump to table of contents
Dump continued from file: /u01/app/oracle/diag/rdbms/obi/obi1/trace/obi1_ora_275091.trc
[TOC00001]
ORA - 00600: internal error code, arguments: [15712], [2], [], [], [], [], [], [], [], [], [], []
[TOC 0001 - END]
[TOC00002]
========= Dump for incident 117130 (ORA 600 [15712]) ========
*** 2017-09-26 10: 44: 50.166
dbkedDefDump (): Starting incident default dumps (flags = 0x2, level = 3, mask = 0x0)
[TOC00003]
----- Current SQL Statement for this session (sql_id = b928a7sazgnzv) -----
select / * + FULL (TAB001_TT01) * / ‘TAB001_TT01‘, count (*) from u01.TAB001_TT01 group by ‘TAB001_TT01‘
[TOC 0003 - END]
----------------------------------------------------------------------------------------------------------
然后，最重要的一点，在Incident 文件中，查找 "client details" 关键字，可以得到更详细的信息。
这样就可以要求客户通过查看 连接信息，看看是谁在那个时间点作了操作，回忆起事件发生前到底作了什么。
信息如下所示：
----------------------------------------------------------------------------------------------------------
client details:
O / S info: user: oracle, term:, ospid: 270035
machine: test01.m0.facjian001.com program: [email protected] (TNS V1 - V3)
application name: [email protected] (TNS V1 - V3), hash value = 3897236877
----------------------------------------------------------------------------------------------------------