Method and apparatus for detecting and recovering from data corruption of database via read logging

Abstract

A method of detecting and recovering from data corruption of a database is characterized by the step of logging information about reads of a database in memory to detect errors in data of the database, wherein said errors in data of said database arise from one of bad writes of data to the database, of erroneous input of data to the database by users and of logical errors in code of a transaction. The read logging method may be implemented in a plurality of database recovery models including a cache-recovery model, a prior state model a redo-transaction model and a delete transaction model. In the delete transaction model, it is assumed that logical information is not available to allow a redo of transactions after a possible error and the effects of transactions that read corrupted data are deleted from history and any data written by a transaction reading Ararat data is treated as corrupted.

Description

[0001] This application claims priority and is related by subject matter to U.S. application Ser. No. 08 / 766,096, entitled "System and Method for Restoring a Distributed Checkpointed Database," of Bohannon et al., to U.S. application Ser. No. 08 / 767,048, entitled "System and Method for restoring a Multiple Checkpointed Database in View of Loss of Volatile Memory" of Bohannon et al., both applications being filed Dec. 16, 1996 and to U.S. Provisional Patent Application Serial No.'s 60 / 099,265 and 60 / 099,271, filed Sep. 4, 1998 of Bohannon et al.[0002] 1. Technical Field[0003] The present invention relates to the field of database management systems generally and, more particularly, to method and apparatus for detecting and recovering from data corruption of a database by codewording regions of the database and by logging information about reads of the database.[0004] 2. Description of the Related Arts[0005] A database is a collection of data organized usefully and fundamental to many...

AI Technical Summary

Problems solved by technology

In all these systems, direct access to data (either in the database buffer cache or in a memory-mapped portion of the database) by application programs is critical to providing fast response times. The alternative to memory mapping is to access data via a server process, but this presents an unacceptable solution due to the high cost of inter-process communication.

Application code is typically less trustworthy than database system code, and there is therefore a significant risk that "wild writes" and other programming errors can affect persistent data in systems that allow applications to access such data directly.

Since the systems described above are increasingly popular, the risk of wild writes and associated physical corruption is growing.

Additionally, there is a risk of damage due to software faults in the DBMS itself.

Data is "directly" corrupted in a physical corruption sense by "unintended" updates, such as wild writes as explained above due to programming errors in the physical case, or arising from incorrectly coded updates or input errors (human errors) in the logical case.

Data written in this manner is indirectly corrupted, and the process involved is said to have carried the corruption.

While this process may be a database maintenance process, we focus on transaction-carried corruption, a problem in which the carrying process is executing transactions.

However, this can be very expensive, for example, on standard UNIX systems.

However, type-safe languages have yet to be proven in high-performance situations, and sandboxing may perform poorly on certain architectures.

Finally, communication across process domain boundaries to a database server process provides protection, but such communication is orders of magnitude slower than access in the same process space, even with highly tuned implementations.

Finally, some work has raised concern over damage to data due to faults in the DBMS itself

We consider such cases inherently impossible to prevent, and instead assume that the problem is detected later, usually when a database user notices incorrect output (on a bank statement, for example).

Images