今天发现存储增长情况不太正常，查一下rman备份日志发现报错如下：

RMAN>
sql statement: ALTER SESSION SET NLS_DATE_FORMAT="YYYY-MM-DD HH24:MI:SS"

RMAN>
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-00558: error encountered while parsing input commands
RMAN-01009: syntax error: found "identifier": expecting one of: "allocate, alter, backup, beginline, blockrecover, catalog, change, connect, copy, convert, create, cros
scheck, configure, duplicate, debug, delete, drop, exit, endinline, flashback, host, {, library, list, mount, open, print, quit, recover, register, release, replace, re
port, renormalize, reset, restore, resync, rman, run, rpctest, set, setlimit, sql, switch, spool, startup, shutdown, send, show, test, transport, upgrade, unregister, v
alidate"
RMAN-01008: the bad identifier was: ERROR
RMAN-01007: at line 1 column 1 file: standard input

最近也没有更新过备份脚本，但是在两天前更新sys用户的密码，系统有Data guard灾备库；

原则上没人改过，但是因OS的oracle、root用户密码等都是当时设定的密码（部分人知道），后来没有改过，因此也不敢保证没有人改过。从last命令结果来看，故障报错那天没有人登录过。

$last |more

oracle pts/5 128.129.2.1 Tue Aug 16 11:42 still logged inoracle pts/4 128.129.2.2 Tue Aug 16 11:41 still logged in.....

仔细观察备份相关脚本后发现就是密码改动导致的，具体如下：

$more delarch.sh

#!/bin/bash

. /export/home/oracle/.bash_profile

SH_HOME=/export/home/oracle/rman

cd $SH_HOME

echo "rman target / log log/rmandelarch_`date +"%Y%m%d"`.log append << !">rman_delete_arch.sh

echo "crosscheck archivelog all;">>rman_delete_arch.sh

echo "SQL 'ALTER SESSION SET NLS_DATE_FORMAT="YYYY-MM-DD HH24:MI:SS"';">>rman_delete_arch.sh

sqlplus -s "sys/abc123@standby as sysdba">>rman_delete_arch.sh << !

SET head off

SET feedback off

SELECT 'delete noprompt archivelog until time '''||to_char(MAX(FIRST_TIME),'YYYY-MM-DD HH24:MI:SS')||''';' FROM v$archived_log WHERE applied='YES';

exit

!

echo "exit;">>rman_delete_arch.sh

echo "!">>rman_delete_arch.sh

sh rman_delete_arch.sh

以上脚本是为了避免还没有应用到备库的归档日志还没有被传输到备库服务器而被删除，而从主库服务器中远程登录到备库，取出应用完归档的最大时间，根据该时间来删除主库上的归档日志的。改完相应的密码后故障已被排除。

总结：数据库sys、system用户密码改动一般可能在备份、sqlloader脚本或dblink等用到环境中正好被用到的。因此在修改之前有必要仔细核查。