CyberSense - RMAN corruption - PAGE XYZ: BLOCK HEADER MARKED AS CORRUPTED BY RMAN

Summary: RMAN CORRUPTION - PAGE XYZ: BLOCK HEADER MARKED AS CORRUPTED BY RMAN marking the copy Suspicious.

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

Copy is marked as suspicious.

/opt/ie/var/ie_run.log reports the following:
  
2023/01/27 17:29:24 error: OracleDB: Detected 1 anomalies including 1 Rman corruptions: 1:[Page 3316413: block header marked as corrupted by RMAN]

The corrupt status message found in the Analysis user interface, or in manual search results, indicates that the "block header marked as corrupted by RMAN”.

Cause

A corrupt status message of "Page XYZ: block header marked as corrupted by RMAN" is an indication that RMAN placed information in the header file to indicate RMAN corruption.

Resolution

The database administrator should investigate why RMAN marks this backup as corrupt.
The database marked corrupt by RMAN should not be reported in a case to Index Engines.

See the following Oracle documentation: https://docs.oracle.com/en/database/oracle/oracle-database/21/bradv/validating-database-files-backups.html#GUIDCC967929-9610-410D-B881-66E71353D84C  image.png

Additional Information

Testing with both good and corrupt backup files confirms that only the corrupt file alerts. See the attached test results. The header was modified to cause the corruption, for purposes of testing.

Clean
output showing not corrupt file

Corrupt
output showing corrupt file
 
 

Affected Products

CyberSense
Article Properties
Article Number: 000210768
Article Type: Solution
Last Modified: 06 Jun 2023
Version:  2
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.