Posts

yum install perf git clone https://github.com/brendangregg/FlameGraph.git touch perf.sh pids=$(pgrep $1 | head -n 4) rm -rf ./tmp_graph mkdir ./tmp_graph for pid in $pids; do echo "-- collecting data for $pid" perf record -F 600 -p $pid -g -- sleep 5 perf script -i perf.data > ./tmp_graph/perf.unfold.$pid ./flame/stackcollapse-perf.pl ./tmp_graph/perf.unfold.$pid > ./tmp_graph/perf.folded.$pid done cat ./tmp_graph/perf.folded.* > ./tmp_graph/all.folded ./flame/flamegraph.pl ./tmp_graph/all.folded > ./all.svg sh perf.sh 进程名 rm -rf ./tmp_graph mkdir ./tmp_graph pid=$1 echo "-- collecting data for $pid" perf record -F 600 -p $pid -g -- sleep 5 perf script -i perf.data > ./tmp_graph/perf.unfold.$pid ./flame/stackcollapse-perf.pl ./tmp_graph/perf.unfold.$pid > ./tmp_graph/perf.folded.$pid done cat ./tmp_graph/perf.folded.* > ./tmp_graph/all.folded ./flame/flamegraph.pl ./tmp_graph/all.folded > ./all.svg

1 E100 fdw +---- | User | 定义外表 -- \c atlasdb -- ALTER SYSTEM SET password_encryption = 'scram-sha-256'; -- SELECT pg_reload_conf(); -- SHOW password_encryption; -- 外部数据库：fdb1 CREATE DATABASE fdb1; CREATE USER fu1 PASSWORd 'QAZ2wsx@123'; \c fdb1 set role fu1; CREATE TABLE ft1 (c1 INT); INSERT INTO ft1 VALUES (11); reset role; -- 配置本地数据库 \c atlasdb CREATE EXTENSION postgres_fdw; CREATE USER u1 PASSWORD 'u1.password'; CREATE SERVER s1 FOREIGN DATA WRAPPER postgres_fdw OPTIONS (host '172.16.100.134', port '5432', dbname 'fdb1'); GRANT ALL ON FOREIGN SERVER s1 TO u1; set role u1; CREATE FOREIGN TABLE t1 (c1 INT) SERVER s1 OPTIONS (schema_name 'public', table_name 'ft1'); CREATE USER MAPPING FOR u1 SERVER s1 OPTIONS (user 'fu1', password 'QAZ2wsx@123'); -- 配置远程登录 echo 'host all u1 0.0.0.0/0 md5' >> $PG_HOME/data/atlasdb_hba.conf echo 'host all fu1 0.0.0.0/0 md5' >> $PG_HOME/data/atlasdb_hba.conf echo "listen_addresses='0.0.0.0'" >> $PG_HOME/data/atlasdb.conf pstop pstart -- 访问外表 set role u1; SELECT * FROM t1; SELECT * FROM pg_user_mapping; -- clean DROP SERVER s1 CASCADE; DROP USER u1; DROP DATABASE fdb1; DROP USER fu1; 2 G100 fdw 安装外部集群 ...

1 多线程框架 gcc thd.c -lpthread -o thd #include <stdio.h> #include <stdlib.h> #include <string.h> #include <stdbool.h> #include <pthread.h> #include <unistd.h> #include <semaphore.h> bool prtlog = true; #define ASSERT(cond) \ if (!(cond)) {printf("ASSERT | file: %s line: %d func: %s\n", __FILE__, __LINE__, __FUNCTION__); exit(-1);} #define LOG(thdctl, fmt, ...) \ do { \ if (prtlog) { \ char data_[2048]; \ snprintf(data_, 2048, (fmt), ##__VA_ARGS__); \ thdctl != NULL ? \ printf(" >%-3d %s\n", ((ThdCtl *)(thdctl))->id, data_) : \ printf("%s\n", data_); \ } \ } while (0) /* ---------------------------------------------------------------------- */ typedef struct ThdCtl ThdCtl; typedef struct ThdData ThdData; typedef void (*ThdHookFunc)(ThdCtl *thdctl, ThdData *data); struct ThdCtl { /* thread info */ int stat; pthread_t thd; int id; /* thread function */ ThdHookFunc init_func; ThdHookFunc exec_func; ThdHookFunc exit_func; ThdData *data; /* thread control */ bool iswait; sem_t wait; }; typedef struct { int thdnum; ThdCtl *thdarr[10000]; } ProCtl; /* ---------------------------------------------------------------------- */ void multi_execute(ThdHookFunc initfunc, ThdHookFunc execfunc, ThdHookFunc exitfunc, int thdnum, ThdData *dataarr); typedef struct ThdData { int id; } ThdData; void init(ThdCtl *thdctl, ThdData *data) { LOG(thdctl, "init"); data->id = thdctl->id; } void execute(ThdCtl *thdctl, ThdData *data) { LOG(thdctl, "execute, id: %d", data->id); } void finish(ThdCtl *thdctl, ThdData *data) { LOG(thdctl, "finish, id: %d", data->id); } int main() { ThdData datas[10] = {0}; multi_execute(init, execute, finish, 10, datas); return 0; } /* ---------------------------------------------------------------------- */ void *thread_main(void *arg) { ThdCtl *tctl = (ThdCtl *)arg; if (tctl->init_func != NULL) { tctl->init_func(tctl, tctl->data); } /* wait to be wake up */ // LOG(tctl, "sleep"); sem_wait(&tctl->wait); /* wake up now */ // LOG(tctl, "wakeup"); tctl->iswait = false; /* ====== user funtion begin ========== */ if (tctl->exec_func != NULL) { tctl->exec_func(tctl, tctl->data); } /* ====== user funtion finish ========== */ if (tctl->exit_func != NULL) { tctl->exit_func(tctl, tctl->data); } return NULL; } ThdCtl *create_thread(ProCtl *process, ThdHookFunc initfunc, ThdHookFunc execfunc, ThdHookFunc exitfunc, void *thddata) { static int thdid = 0; ThdCtl *t = (ThdCtl *)malloc(sizeof(ThdCtl)); if (t == NULL) { ASSERT(false); return NULL; } /* thread info */ t->stat = -1; t->id = thdid++; /* thread function */ t->init_func = initfunc; t->exec_func = execfunc; t->exit_func = exitfunc; t->data = thddata; t->stat = pthread_create(&t->thd, NULL, thread_main, t); /* thread control */ t->iswait = true; sem_init(&t->wait, 0, 0); process->thdarr[process->thdnum] = t; process->thdnum++; return t; } ProCtl *create_process() { ProCtl *pro = (ProCtl *)malloc(sizeof(ProCtl)); ASSERT(pro != NULL); pro->thdnum = 0; memset(pro->thdarr, 0, sizeof(pro->thdarr)); return pro; } void multi_execute(ThdHookFunc initfunc, ThdHookFunc execfunc, ThdHookFunc exitfunc, int thdnum, ThdData *dataarr) { ProCtl *pro = create_process(); LOG(NULL, "init ------------------------"); int i; for (i = 0; i < thdnum; i++) { create_thread(pro, initfunc, execfunc, exitfunc, &dataarr[i]); } LOG(NULL, "execute ------------------------"); for (i = 0; i < pro->thdnum; i++) { ThdCtl *tctl = pro->thdarr[i]; sem_post(&tctl->wait); } for (i = 0; i < pro->thdnum; i++) { pthread_join(pro->thdarr[i]->thd, NULL); } LOG(NULL, "finish ------------------------"); } 2 多线程示例

# 安装nodejs yum install -y nodejs # 安装claude npm install -g @anthropic-ai/claude-code # 验证 claude --version cd /data/postgresql17 # 5. 启动 Claude Code 并进行首次认证 # 运行后，终端会提供一个链接，在浏览器中完成账号授权即可 claude # 6. (可选但推荐) 生成项目记忆文件 # 在 Claude 交互界面中，输入以下命令，它会分析项目并生成 CLAUDE.md 文件 /init

非国密 生成证书 数据库服务端：配置证书、配置传输加密算法 数据库客户端：配置证书 # 检查openssl版本 which openssl # 确保使用的是vastbase发布包中的openssl，而非操作系统中的openssl cp $GAUSSHOME/share/sslcert/gsql/openssl.cnf ./ export OPENSSL_CONF=`pwd`/openssl.cnf # 创建文件 mkdir cert cd cert mkdir ./demoCA ./demoCA/newcerts ./demoCA/private chmod 700 ./demoCA/private echo '01'>./demoCA/serial touch ./demoCA/index.txt # ca openssl genrsa -out ./demoCA/private/cakey.pem 2048 openssl req -new -key ./demoCA/private/cakey.pem -out ./demoCA/private/ca_cert_req.pem -subj "/C=CN/ST=Beijing/O=huawei/OU=gauss/CN=root" openssl x509 -req -in ./demoCA/private/ca_cert_req.pem -days 7300 -signkey ./demoCA/private/cakey.pem -out ./demoCA/cacert.pem # server openssl genrsa -out server.key 2048 openssl req -new -key server.key -out server.csr -subj "/C=CN/ST=Beijing/O=huawei/OU=gauss/CN=server" openssl x509 -req -in server.csr -days 3650 -CA ./demoCA/cacert.pem -CAkey ./demoCA/private/cakey.pem -CAcreateserial -out server.crt # client openssl genrsa -out client.key 2048 openssl req -new -key client.key -out client.csr -subj "/C=CN/ST=Beijing/O=huawei/OU=gauss/CN=client" openssl x509 -req -in client.csr -days 3650 -CA ./demoCA/cacert.pem -CAkey ./demoCA/private/cakey.pem -CAcreateserial -out client.crt # 查看内容 openssl x509 -in client.crt -text # 设置权限 chmod 600 client.key chmod 600 client.crt chmod 600 server.key chmod 600 server.crt chmod 600 ./demoCA/cacert.pem export CERT=`pwd` echo ' export CERT=`pwd` export PGSSLMODE=verify-ca export PGSSLROOTCERT=$CERT/demoCA/cacert.pem export PGSSLKEY=$CERT/client.key export PGSSLCERT=$CERT/client.crt ' > client_env source client_env # 设置服务端参数 gs_guc set -D $GAUSSHOME/data -c "ssl=on" gs_guc set -D $GAUSSHOME/data -c "ssl_ciphers = 'ALL'" gs_guc set -D $GAUSSHOME/data -c "ssl_ca_file = '$CERT/demoCA/cacert.pem'" gs_guc set -D $GAUSSHOME/data -c "ssl_key_file='$CERT/server.key'" gs_guc set -D $GAUSSHOME/data -c "ssl_cert_file='$CERT/server.crt'" # 重启数据库 vsql -d postgres -c " CREATE USER u1 PASSWORD 'u1.password' " # 连接数据库：需加-h参数 vsql -h localhost -d postgres -U u1 -W 'u1.password' -r rm -f client.* server.* gs_guc set -D $GAUSSHOME/data -c "ssl_ciphers = 'ECDHE-ECDSA-SM4-CBC-SM3'" openssl ecparam -name SM2 -genkey -out ./demoCA/private/cakey.pem openssl req -new -key ./demoCA/private/cakey.pem -out ./demoCA/private/ca_cert_req.pem -subj "/C=CN/ST=Beijing/O=huawei/OU=gauss/CN=root" openssl x509 -req -in ./demoCA/private/ca_cert_req.pem -days 7300 -signkey ./demoCA/private/cakey.pem -out ./demoCA/cacert.pem # server openssl ecparam -name SM2 -genkey -out server.key openssl req -new -key server.key -out server.csr -subj "/C=CN/ST=Beijing/O=huawei/OU=gauss/CN=server" openssl x509 -req -in server.csr -days 3650 -CA ./demoCA/cacert.pem -CAkey ./demoCA/private/cakey.pem -CAcreateserial -out server.crt # client openssl ecparam -name SM2 -genkey -out client.key openssl req -new -key client.key -out client.csr -subj "/C=CN/ST=Beijing/O=huawei/OU=gauss/CN=client" openssl x509 -req -in client.csr -days 3650 -CA ./demoCA/cacert.pem -CAkey ./demoCA/private/cakey.pem -CAcreateserial -out client.crt chmod 600 client.key client.crt server.key server.crt ./demoCA/cacert.pem openssl x509 -in client.crt -text 国密 mkdir cert cd cert openssl version # OpenSSL 1.1.1s Tassl 2.1.2 1 Nov 2022 cp ../tassl/install/openssl.cnf ./ chmod +w ./openssl.cnf echo ' [ gm_ca_cert ] subjectKeyIdentifier=hash authorityKeyIdentifier=keyid:always,issuer basicConstraints = critical,CA:true keyUsage = critical, cRLSign, keyCertSign [ gm_sign_cert ] basicConstraints = CA:FALSE keyUsage = critical, digitalSignature, nonRepudiation [ gm_enc_cert ] basicConstraints = CA:FALSE keyUsage = critical, keyEncipherment, dataEncipherment, keyAgreement' >> ./openssl.cnf mkdir ./demoCA ./demoCA/newcerts ./demoCA/private chmod 700 ./demoCA/private echo '01'>./demoCA/serial touch ./demoCA/index.txt # ca openssl ecparam -name SM2 -genkey -out ./demoCA/private/cakey.pem openssl req -config openssl.cnf -new -key ./demoCA/private/cakey.pem -sm3 -out ./demoCA/private/ca_cert_req.pem -subj "/C=CN/ST=Beijing/O=huawei/OU=gauss/CN=root" openssl x509 -req -extfile openssl.cnf -extensions gm_ca_cert -in ./demoCA/private/ca_cert_req.pem -sm3 -days 7300 -signkey ./demoCA/private/cakey.pem -out ./demoCA/cacert.pem # server openssl ecparam -name SM2 -genkey -out server.key openssl ec -in server.key -passout pass:gauss@123 -sm4 -out server.key openssl req -config openssl.cnf -new -key server.key -passin pass:gauss@123 -sm3 -out server.csr -subj "/C=CN/ST=Beijing/O=huawei/OU=gauss/CN=server" openssl x509 -req -extfile openssl.cnf -extensions gm_sign_cert -in server.csr -sm3 -days 3650 -CA ./demoCA/cacert.pem -CAkey ./demoCA/private/cakey.pem -passin pass:gauss@123 -CAcreateserial -out server.crt # server.enc openssl ecparam -name SM2 -genkey -out server_enc.key openssl ec -in server_enc.key -passout pass:gauss@123 -sm4 -out server_enc.key openssl req -config openssl.cnf -new -key server_enc.key -passin pass:gauss@123 -sm3 -out server_enc.csr -subj "/C=CN/ST=Beijing/O=huawei/OU=gauss/CN=server" openssl x509 -req -extfile openssl.cnf -extensions gm_enc_cert -in server_enc.csr -sm3 -days 3650 -CA ./demoCA/cacert.pem -CAkey ./demoCA/private/cakey.pem -passin pass:gauss@123 -CAcreateserial -out server_enc.crt gs_guc encrypt -M server -D ./ -K gauss@123 # client openssl ecparam -name SM2 -genkey -out client.key openssl ec -in client.key -passout pass:gauss@123 -sm4 -out client.key openssl req -config openssl.cnf -new -key client.key -passin pass:gauss@123 -sm3 -out client.csr -subj "/C=CN/ST=Beijing/O=huawei/OU=gauss/CN=client" openssl x509 -req -extfile openssl.cnf -extensions gm_sign_cert -in client.csr -sm3 -days 3650 -CA ./demoCA/cacert.pem -CAkey ./demoCA/private/cakey.pem -passin pass:gauss@123 -CAcreateserial -out client.crt # client.enc openssl ecparam -name SM2 -genkey -out client_enc.key openssl ec -in client_enc.key -passout pass:gauss@123 -sm4 -out client_enc.key openssl req -config openssl.cnf -new -key client_enc.key -passin pass:gauss@123 -sm3 -out client_enc.csr -subj "/C=CN/ST=Beijing/O=huawei/OU=gauss/CN=client" openssl x509 -req -extfile openssl.cnf -extensions gm_enc_cert -in client_enc.csr -sm3 -days 3650 -CA ./demoCA/cacert.pem -CAkey ./demoCA/private/cakey.pem -passin pass:gauss@123 -CAcreateserial -out client_enc.crt gs_guc encrypt -M client -D ./ -K gauss@123 # openssl x509 -in client.crt -text export CERT=`pwd` echo ' export CERT=`pwd` export PGSSLMODE=verify-ca export PGSSLTLCP=1 export PGSSLROOTCERT=$CERT/demoCA/cacert.pem export PGSSLKEY=$CERT/client.key export PGSSLCERT=$CERT/client.crt export PGSSLENCKEY=$CERT/client_enc.key export PGSSLENCCERT=$CERT/client_enc.crt ' > client_env source client_env # 设置服务端参数 gs_guc set -D $GAUSSHOME/data/single_node -c "ssl=on" gs_guc set -D $GAUSSHOME/data/single_node -c "ssl_ciphers = 'ALL'" gs_guc set -D $GAUSSHOME/data/single_node -c "ssl_use_tlcp=on" gs_guc set -D $GAUSSHOME/data/single_node -c "ssl_ca_file = '$CERT/demoCA/cacert.pem'" gs_guc set -D $GAUSSHOME/data/single_node -c "ssl_key_file='$CERT/server.key'" gs_guc set -D $GAUSSHOME/data/single_node -c "ssl_cert_file='$CERT/server.crt'" gs_guc set -D $GAUSSHOME/data/single_node -c "ssl_enc_key_file='$CERT/server_enc.key'" gs_guc set -D $GAUSSHOME/data/single_node -c "ssl_enc_cert_file='$CERT/server_enc.crt'" # 重启数据库

PQconnectStart makeEmptyPGconn connectOptions1 parse_connection_string fillPGconn conninfo_getval("enable_ce") # 解析 'enable_ce' connectDBStart PQconnectPoll if CONNECTION_NEEDED: # 建立TCP连接 connect elif CONNECTION_MADE: # 发送连接参数 pqBuildStartupPacket3 build_startup_packet pqPacketSend elif CONNECTION_AWAITING_RESPONSE # 进行身份认证 pg_fe_sendauth PQexec PQexecStart PQsendQuery Processor::run_pre_query # 加密SQL语句中的数据 Parser::Parse run_pre_statement run_pre_insert_statement CachedColumnManager::get_cached_columns RawValues::get_raw_values_from_insert_statement ValuesProcessor::process_values process_inside_value # 加密 StatementData::replace_raw_values pqPutMsgStart pqPuts pqPutMsgEnd pqFlush PQexecFinish PQgetResult parseInput pqParseInput3 pqGetc pqGetInt case 'D' getAnotherTuple pqRowProcessor ValuesProcessor::deprocess_value # 解密服务端返回的数据 pqGets case 'Z' Processor::run_post_query pqReadData

2 安装数据库 scp shenkun@172.16.100.134:/home/shenkun/g100/pkg-5-19.tar.gz ./ vast@123 export GAUSSHOME=`pwd` export PATH=$PATH:$GAUSSHOME/bin export LD_ alias vinit='vb_initdb -D $GAUSSHOME/data -w vb.12345 --nodename=db1' alias vstart='vb_ctl start -D $GAUSSHOME/data' alias vrestart='vb_ctl restart -D $GAUSSHOME/data' 3 安装benchmarksql 一、下载benchmarksql # 1.安装java openjdk yum install java yum install java-1.8.0-openjdk-devel # 2.下载benchmark安装包 https://sourceforge.net/projects/benchmarksql/files/latest/download # 3.下载ant安装包 https://dlcdn.apache.org//ant/binaries/apache-ant-1.10.15-bin.tar.gz # 4.解压benchmark与ant安装包 # 建议git初始化benchmark安装包，如果改错了可以回退 二、配置环境变量 # 1.生成环境变量脚本 touch envbm # 在envbm中添加一下内容 export BMROOT=`pwd` export BMCODE=$BMROOT/benchmarksql-5.0 export PATH=$PATH:$BMROOT/apache-ant-1.10.15/bin export DBIP=127.0.0.1 export DBPORT=5432 # 2.配置环境变量 source envbm 三、配置benchmarksql配置文件 # 1.生成配置文件 mkdir cfg cp $BMCODE/run/props.pg $BMROOT/cfg/props.pg # 2.编辑配置文件 sed -i '/^user=/s/=.*/=u1/' f1 # user=bmuser # password=bmuser@123 # warehouses=10 # loadWorkers=10 # terminals=10 # runMins=5 # limitTxnsPerMin=0 # 3. 设置表的fillfictor=80 cp $BMCODE/run/sql.common/tableCreates.sql $BMCODE/run/sql.common/_tableCreates.sql sed -i '/^);/s/);.*/) with (fillfactor=80);/' $BMCODE/run/sql.common/tableCreates.sql 四、生成便捷使用benchmarksql的脚本 ...

1 审计的背景 1.1 审计的原理 在使用数据库存取数据的大部分场景中，数据库具有以下特点： 对象多：一个数据库集群中有多个database对象，1个database对象中有多个schema对象，1个schema对象中有多个table、index等对象 用户多：一个数据库中，有多个用户，每个用户可访问的数据库对象不同 应用多：多个应用将数据存储在同一数据库集群中，并同时访问数据库集群 操作多：数据库提供丰富的功能，包括DDL、DML、DCL、运维等 运行久：一个数据库集群，可能会保持数十年运行 审计的主要目的，使记录数据运行过程中发生了哪些事件。审计的3要素是： 主体：一般指数据库用户 客体：一般指数据库对象，包括：集群、数据对象（database、schema、table、index、function等）、用户等 操作：主体对客体的操作，比如某个用户访问了某个表 1.2 审计的目的 审计具有以下重要意义： 合法合规：《网络安全法》等法律法规与表中中，要求应用通过《等保测评》等标准，标准中要求应用具备审计功能 故障检测：当数据库出现故障时，协助快速定位问题 攻击检测：通过检查审计日志，可判断是否发生网络安全攻击事件 例行维护：通过检查审计日志，可跟踪对某个对象的访问信息 … 等保测评要求标准（GB/T 28448）中，对审计的要求如下： 审计范围 全面性 细粒度：登录、访问、修改、删除等 审计内容 用户行为：登录、登出、权限变更 数据访问：敏感数据查询、插入、更新、删除等 异常行为：登录失败、非法访问 审计记录 详细性：时间戳、用户标识、操作类型、操作结果、IP地址等 不可篡改：真实性、完整性 存储安全：未经授权的访问和修改 审计管理 审计策略：审计的目标、范围、内容和频率 审计分析：定期分析审计记录 审计报告 1.3 审计的功能 审计功能包含以下3个部分： 配置审计功能：日志存储策略等 设置审计范围：设置哪类操作、哪类对象、..需要给设计 生成审计日志：运行时，生成审计日志 管理审计日志：查询，删除，归档审计日志 1.4 oracle审计 oracle审计的发展： oracle 8i及更早：支持传统审计 oracle 12c：新增支持统一审计 oracle 23ai：不支持传统审计，仅支持统一审计 oracle统一审计的使用： -- 1 设置审计范围：创建审计策略 CREATE AUDIT POLICY ap1 PRIVILEGES CREATE TABLE, ALTER USER -- privilege 子句，记录所有使用CreateTable, AlterUser权限的操作，oracle 12c中，支持256种权限 ACTIONS SELECT,INSERT,UPDATE ON t1 -- aciton 子句，记录所有对表t1执行SELECT,INSERT,UPDATE的操作 ROLES r1; -- role 子句，记录所有使用r1角色的操作 -- 2 启用审计策略 AUDIT POLICY ap1; -- 3 查看审计日志（完整日志） SELECT * FROM UNIFIED_AUDIT_TRAIL; -- 查看关键日志 SELECT * FROM DBA_AUDIT_TRAIL; -- 其他：DBA_COMMON_AUDIT_TRAIL, DBA_AUDIT_SESSION, DBA_AUDIT_OBJECT, DBA_FGA_AUDIT_TRAIL os_username | username | userhost | terminal | timestamp | owner | obj_name | action | action_name | ------------+----------+----------+----------+-----------+-------+----------+--------+-------------+ | new_owner | new_name | obj_privilege | sys_privilege | admin_option | grantee | audit_option | ses_actions | +----------+----------+---------------+---------------+--------------+---------+--------------+-------------+ logoff_time | logoff_lread | logoff_pwrite | logoff_dlock | comment_text | sessionid | entryid | statementid | returncode | +-----------+--------------+---------------+--------------+--------------+-----------+---------+-------------+------------+ | priv_used | client_id | econtext_id | session_cpu | extended_timestamp | proxy_sessionid | global_uid | instance_number | +-----------+-----------+-------------+-------------+--------------------+-----------------+------------+-----------------+ os_process | transactionid | scn | sql_bind | sql_text | obj_edition_name | dbid | rls_info | current_user | +----------+---------------+-----+----------+----------+------------------+------+----------+--------------+ 其中，可设置的权限、操作等范围如下： ...

virtCCA 1 升级的流程 升级分类： 就地升级：暂停业务 灰度升级：不暂停业务，一次升级所有节点 节点升级：基于灰度升级，可升级部分节点 升级流程：（此处的命令是简化版命令，不能直接执行） 准备升级：检查安装包 开始升级：停止、启动集群，修改系统表 mkdir new_pkg gs_preinstall -X config.xml gs_upgradectl -t auto-upgrade -X config.xml --grey 验证升级 gsql -V gaussdb -V gsql -d postgres -p 5432 -c 'select working_version_num();' # 旧版本 提交升级 gs_upgradectl -t commit-upgrade -X config.xml --grey 回滚升级 gs_upgradectl -t auto-rollback -X config.xml 2 升级的原理 安装包 |-- install |-- share |-- postgresql |-- postgresql.conf.sample |-- postgres.bki |-- system_views.sql |-- extension |-- ... main parseCommandLine checkParameter initGlobalInfos initClusterInfo UpgradeImplOLAP run Upgrade.run UpgradeImpl.run # UpgradeImpl.py initGlobalInfos commonCheck if 'auto_upgrade' doGreyBinaryUpgrade distributeXml checkUpgrade # 检查环境变量 'Local_Check_Upgrade -t action -R oldapppath -l locallog -N newapppath -X config.xml' doHealthCheck checkClusterStatus checkConnection chooseUpgradeNodes prepareGreyUpgrade createBakPath 'mkdir upgradeBackupPath' initNodeStepInCsv 'touch upgrade_step.csv_bak' initUpgradeProcessStatus recordNodeStepInplace recordDirFile 'touch record_app_directory' writeFile('oldClusterAppPath') copyBakVersion 'cp oldapppath/bin/upgrade_version upgradeBackupPath/upgrade_version' installNewBin 'Local_Install -t install_cluster -U user:group -R newapppath -P tmpdir -c clustername -l locallog -X config.cml -T -u' cpDolphinUpgradeScript 'cp oldapppath/share/postgresql/extension/dolphin* newapppath/share/postgresql/extension/' prepareUpgradeSqlFolder # catalog upgrade_sql.tar.gz, including guc 'Local_Upgrade_Utility -t prepare_upgrade_sql_folder -U user --upgrade_bak_path upgradeBackupPath -X config.xml -l locallog' updateCatalog 'cp upgradeBackupPath/upgrade_sql/ {upgrade-post, upgrade, rollback-post, rollback}' doUpgradeCatalog setUpgradeFromParam 'gs_guc set -Z cmagent -N all -I all -c upgrade_from=working_grand_version' reload_cm_proc setUpgradeMode(2) reloadCmAgent killKernalSnapshotThread execRollbackUpgradedCatalog('rollback') execRollbackUpgradedCatalog('upgrade') pgxcNodeUpdateLocalhost("upgrade") rebuild_pg_proc_proname_args_nsp_new_index upgradeAgain greySyncGuc 'Local_Upgrade_Utility -t grey_sync_guc -U user --upgrade_bak_path=upgradeBackupPath -l logcallog' greySyncGuc # script/local/UpgradeUtility.py readDeleteGuc greySyncInstanceGuc greyUpgradeSyncOldConfigToNew 'Local_Upgrade_Utility -t grey_upgrade_config_sync -U user -V oldversionnumber --old_cluster_app_path=oldapppath --new_cluster_app_path=newapppath -l locallog' greyUpgradeSyncConfig # 适配点, 参考 setUpradeModeGuc( getOneDNInst switchBin 'Local_Upgrade_Utility -t switch_bin -U user -l localog -R new?oldapppath' restore_origin_disaster_user_file setNewVersionGuc switchExistsProcess _check_and_start_cluster 'gs_om -t start' createCheckpoint switchDn waitClusterNormalDegrade doHealthCheck waitClusterForNormal backupGlobalRelmapFile printPrecommitBannervstart elif 'commit': doGreyCommitUpgrade 参考 opengauss om源码：https://gitee.com/opengauss/openGauss-OM opengauss升级：https://docs.opengauss.org/zh/docs/latest/docs/DatabaseOMGuide/upgrade.html

1 身份认证 身份认证 大部分数据库都支持基于口令的身份认证，以vastbase为例，身份认证的流程如下： 高权限用户创建新用户 CREATE USER u1 PASSWORD 'u1.pass1'; 数据库在pg_authid系统表中存储用户以及密码的哈希 SELECT oid, rolname, rolvalidbegin, rolpassword FROM pg_authid WHERE rolname = 'u1'; oid | rolname | rolvalidbegin | rolpassword -------+---------+---------------+-------------------------------------------------------------------------- 24576 | u1 | | sha2565e3b533ca5db32acdffdb6aea03395af163ac3cfdc9ddb....... 数据库在pg_auth_history系统表中存储密码创建时间 SELECT roloid, passwordtime FROM pg_auth_history; oid | passwordtime -------+------------------------------- 24576 | 2025-02-11 12:17:02.969642+08 新用户登录数据库 gsql -d postgres -U u1 -W 'u1.pass1' -r 数据库校验新用户信息：数据库接收用户建立连接的请求时，会进行一系列身份鉴别操作，包括：检查用户提供的密码与pg_authid中的值是否匹配，检查pg_auth_history中记录的密码生成日期与当前日期是否间隔较久等 ...