--SYSTEM表空间不足的报警 
登录之后，查询，发现是sys.aud$占的地方太多。 
SQL> select owner, segment_name, segment_type, sum(bytes)/1024/1024 space_m  
  from dba_segments  
  where tablespace_name = 'SYSTEM'  
group by owner, segment_name, segment_type 
having sum(bytes)/1024/1024 >= 20 
order by space_m desc 
; 
 4  5  6  7  
OWNER  SEGMENT_NAME   SEGMENT_TYPE SPACE_M 
-------- ------------------------------- ------- 
SYS   AUD$       TABLE      4480 
SYS   IDL_UB1$     TABLE       272 
SYS   SOURCE$      TABLE       72 
SYS   IDL_UB2$     TABLE       32 
SYS   C_OBJ#_INTCOL#  CLUSTER      27 
SYS   C_TOID_VERSION#  CLUSTER      24 
6 rows selected. 
SQL> 
查看是哪个记得比较多。 
col userhost format a30 
select userid, userhost, count(1) from sys.aud$  
where ntimestamp# >=CAST(to_date('2014-03-01 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  
group by userid, userhost 
having count(1) > 500 
order by count(1) desc 
; 
再继续找哪天比较多。 
select to_char(ntimestamp#, 'YYYY-MM-DD') audit_date, count(1)  
from sys.aud$  
where ntimestamp# >=CAST(to_date('2014-03-01 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  
and userid = 'xxxx' and userhost = 'xxxx' 
group by to_char(ntimestamp#, 'YYYY-MM-DD')  
order by count(1) desc 
; 
select spare1, count(1) from sys.aud$  
where ntimestamp# between CAST(to_date('2014-03-10 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  
and CAST(to_date('2014-03-11 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP) 
and userid = 'xxxx' and userhost = 'xxxx' 
group by spare1 
; 
select action#, count(1) from sys.aud$  
where ntimestamp# between CAST(to_date('2014-03-10 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  
and CAST(to_date('2014-03-11 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP) 
and userid = 'xxxx' and userhost = 'xxxx' 
and spare1 = 'xxxx' 
group by action# 
order by count(1) desc 
; 
结果如下： 
  ACTION#  COUNT(1) 
---------- ---------- 
    101   124043 
    100   124043 
SQL> 
其实是上次打开的audit一直没有关闭。 
关闭： 
SQL> noaudit session; 
清空： 
truncate table sys.aud$; 
------------------------------------------------------------------------ 
实战 
------------------------------------------------------------------------ 
--1,查询表空间占用情况 
select dbf.tablespace_name as tablespace_name, 
     dbf.totalspace as totalspace, 
     dbf.totalblocks as totalblocks, 
     dfs.freespace freespace, 
     dfs.freeblocks freeblocks, 
     (dfs.freespace / dbf.totalspace) * 100 as freeRate  
     from (select t.tablespace_name, 
     sum(t.bytes) / 1024 / 1024 totalspace, 
     sum(t.blocks) totalblocks 
     from DBA_DATA_FILES t 
     group by t.tablespace_name) dbf, 
     (select tt.tablespace_name, 
     sum(tt.bytes) / 1024 / 1024 freespace, 
     sum(tt.blocks) freeblocks 
     from DBA_FREE_SPACE tt 
     group by tt.tablespace_name) dfs 
     where trim(dbf.tablespace_name) = trim(dfs.tablespace_name) 
--2,查看哪里占的比较多 SYSTEM 为step1中查询 tablespace_name 内容 
select owner, segment_name, segment_type, sum(bytes)/1024/1024 space_m  
  from dba_segments  
  where tablespace_name = 'SYSTEM'  
group by owner, segment_name, segment_type 
having sum(bytes)/1024/1024 >= 20 
order by space_m desc 
--3,查看是哪个记得比较多 count(1) 越大,说明占得比较多 
select userid, userhost, count(1) from sys.aud$  
where ntimestamp# >=CAST(to_date('2014-03-01 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  
group by userid, userhost 
having count(1) > 500 
order by count(1) desc 
--4,再继续找哪天比较多 userid userhost 为上一步查询内容 
select to_char(ntimestamp#, 'YYYY-MM-DD') audit_date, count(1)  
from sys.aud$  
where ntimestamp# >=CAST(to_date('2015-03-01 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  
and userid = 'userid' and userhost = 'userhost' 
group by to_char(ntimestamp#, 'YYYY-MM-DD')  
order by count(1) desc 
; 
select spare1, count(1) from sys.aud$  
where ntimestamp# between CAST(to_date('2016-03-10 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  
and CAST(to_date('2016-12-11 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP) 
and userid = 'userid' and userhost = 'userhost' 
group by spare1 
; 
--spare1 为上一步查询内容 
select action#, count(1) from sys.aud$  
where ntimestamp# between CAST(to_date('2016-03-10 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP)  
and CAST(to_date('2016-12-11 00:00:00', 'YYYY-MM-DD hh24:mi:ss') AS TIMESTAMP) 
and userid = 'userid' and userhost = 'userhost' 
and spare1 = 'Administrator' 
group by action# 
order by count(1) desc 
--5,关闭seeion 
noaudit session; 
--6,清空： 
truncate table sys.aud$;