Shadow Lost Write Protection in Oracle:
A Practical Defense Against Silent Storage Failures
Introduction
What happens when Oracle Database believes a block was written successfully, but the write never actually reaches storage?
That silent failure is known as a lost write, and it can lead to data corruption before anyone realizes there is a problem.
In this post, I explain how Shadow Lost Write Protection works, how it differs from `DB_LOST_WRITE_PROTECT`, and how database administrators can use it to detect lost writes early and protect critical data.
A practical look at Oracle database protection, SCN-based tracking, shadow tablespaces, and the configuration steps every DBA should understand
What is silent storage problem that can affect your database blocks?
A database can report that a block write completed even when the data never reached persistent storage. In another form of the same problem, an older copy of a block can overwrite a newer copy. Oracle refers to this as a lost write. If the stale block is later read and used in a transaction, the result may be logical corruption that is difficult to diagnose and expensive to repair.
This is where Shadow Lost Write Protection becomes valuable. It gives Oracle Database a way to identify a lost write when a tracked block is read, before the incorrect block is consumed by another operation. The feature is designed for fast detection and an immediate database error, helping reduce the potential scope of corruption and the time needed for recovery.
How it works
Shadow Lost Write Protection uses one or more dedicated shadow tablespaces. These are special-purpose bigfile tablespaces that store tracking information, specifically, the System Change Number (SCN) associated with blocks in protected data files. The shadow tablespace does not store a second copy of the application data.
When Oracle reads a protected block from disk, it compares the SCN recorded in the shadow tablespace with the SCN in the block being read. If the shadow entry has a newer SCN than the block on disk, Oracle has evidence that the disk contains an older image. It raises an error rather than allowing the stale block to flow into subsequent DML or recovery operations.
This distinction matters: Shadow Lost Write Protection does not repair a failed storage subsystem, and it is not a substitute for backups, Recovery Manager, Data Guard, or sound storage design. Its role is to detect the problem early and prevent the stale block from being silently reused.
A practical implementation sequence
Before enabling the feature, confirm that the database compatibility level is 18.0.0 or higher, and decide which data is important enough to track. Oracle allows protection at the tablespace or individual data-file level, so a phased approach is often more practical than enabling it everywhere at once.
1. Create a shadow tablespace
A shadow tablespace must be a bigfile tablespace and is created with the `LOST WRITE PROTECTION` clause. Oracle’s guidance recommends allocating shadow space equal to at least 2% of the space used by the protected data files.
CREATE BIGFILE TABLESPACE shadow_lwp1
DATAFILE '/u02/oradata/DB1/shadow_lwp1.dbf'
SIZE 10G
LOST WRITE PROTECTION;
Choose the file location carefully. The shadow tablespace should be monitored like any other database-critical storage area, with appropriate capacity planning, alerting, backup considerations, and failure-domain separation where the platform design permits it.
2. Enable the feature for the database
For a multitenant container database root, use `ALTER DATABASE`. For a pluggable database, use `ALTER PLUGGABLE DATABASE`. At least one shadow tablespace must exist before the database-level feature can be enabled.
-- From the CDB root
ALTER DATABASE ENABLE LOST WRITE PROTECTION;
-- From a PDB
ALTER PLUGGABLE DATABASE ENABLE LOST WRITE PROTECTION;
In a multitenant environment, remember that enabling or disabling the feature in the CDB root does not automatically change the setting for each PDB. Treat the CDB and PDB configuration as separate administrative decisions.
3. Protect the most important data first
Protection can be applied to an entire tablespace or to selected data files. Enabling it for a tablespace also covers its current data files and data files added later to that tablespace.
-- Protect all current and future data files in a tablespace
ALTER TABLESPACE business_data
ENABLE LOST WRITE PROTECTION;
-- Protect one data file used by the CDB root
ALTER DATABASE DATAFILE
'/u02/oradata/DB1/business_data01.dbf'
ENABLE LOST WRITE PROTECTION;
-- Protect one data file used by a PDB
ALTER PLUGGABLE DATABASE DATAFILE
'/u02/oradata/PDB1/business_data01.dbf'
ENABLE LOST WRITE PROTECTION;
A sensible starting point is to protect the tablespaces that contain the most business-critical data, such as financial transactions, customer records, inventory, or other data that would be difficult to reconstruct. The right scope depends on the database’s recovery objectives, storage capacity, and operational risk assessment.
Operational points administrators should not overlook
Shadow Lost Write Protection is active for normal DML, SQL*Loader conventional and direct path loads, and RMAN backups. During an RMAN backup, Oracle checks the blocks being read and raises an error if it finds a lost write. This makes backup operations another opportunity to discover storage-related inconsistencies.
Capacity monitoring is essential. If a protected data file grows, Oracle attempts to expand the corresponding tracking data. When the shadow tablespace cannot accommodate all required tracking information, Oracle logs a warning and continues tracking what it can. That is not a condition to ignore: it means the protection coverage may no longer match the intended design.
There is also an important difference between suspending and removing protection. Suspending stops new tracking and checking but preserves the existing tracking data, allowing protection to be resumed later. Removing protection deletes the tracking information for that data file or tablespace, so it cannot be reused if protection is enabled again.
-- Pause protection but retain existing tracking information
ALTER TABLESPACE business_data
SUSPEND LOST WRITE PROTECTION;
-- Stop protection and delete the associated tracking information
ALTER TABLESPACE business_data
REMOVE LOST WRITE PROTECTION;
📙A database flashback also removes Shadow Lost Write Protection data. After the flashback, Oracle rebuilds tracking information as protected data is repopulated and updated. This should be included in any flashback runbook and post-operation validation.
What happens when a lost write is detected?
Oracle returns an error for the affected block rather than silently using it. The administrator should treat that event as a storage and recovery incident: preserve the diagnostic information, review the database and storage logs, identify the affected data file and block, validate the health of the I/O path, and recover the affected data using the organization’s approved Oracle recovery procedures.
Oracle documents the related error as ORA-65478, indicating that a lost write was found in a data block protected by lost write protection. The exact recovery action depends on the database architecture, backup availability, corruption scope, and operational recovery plan; Shadow Lost Write Protection is the detection and early-warning layer, not the repair procedure.
The key takeaway
Lost writes are dangerous because they can remain invisible until stale data is read and reused. Shadow Lost Write Protection adds a focused integrity check to Oracle Database by maintaining SCN-based tracking outside the protected data files and comparing that history whenever blocks are read.
For many environments, the best implementation is not “enable it everywhere without a plan.” It is to start with the most valuable tablespaces, size the shadow tablespace appropriately, place it under active monitoring, test the alert and recovery workflow, and expand coverage as operational confidence grows.
In short, Shadow Lost Write Protection helps turn a silent storage failure into a detectable database event, early enough for the DBA team to investigate before the stale block becomes part of a larger corruption problem.
Write protection vs. shadow lost write protection
They address the same class of storage failure, but they are separate Oracle features.
Shadow Lost Write Protection is not configured through `DB_LOST_WRITE_PROTECT`, and enabling one does not automatically enable the other.
How Does Oracle protect against Lost Writes ?
Since Oracle Database 11.1, Oracle has provided the DB_LOST_WRITE_PROTECT database parameter to help detect and protect against Lost Writes providing the following values { TYPICAL | FULL | NONE}
- FULL: on the primary database, the instance logs reads for read-only tablespaces and read/write tablespaces.
- TYPICAL: on the primary database, the instance logs buffer cache reads for read/write tablespaces in the redo log, which is necessary for detection of lost writes.
- NONE: on either the primary database or the standby database, no lost write detection functionality is enabled.(DEFAULT)
What’s Changed ?
The recent Oracle Database RU 19.26 release introduces a new DB_LOST_WRITE_PROTECT value ‘AUTO’.
This is now the default setting for Oracle Database 19.26 onwards.
DB_LOST_WRITE_PROTECT` in practice
The parameter has three settings:
DB_LOST_WRITE_PROTECT = { AUTO | TYPICAL | FULL | NONE }
ALTER SYSTEM SET DB_LOST_WRITE_PROTECT = TYPICAL SCOPE=BOTH;
With `TYPICAL` on the primary database, Oracle logs buffer-cache reads for read/write tablespaces in the redo stream. With `TYPICAL` or `FULL` on the standby database, Oracle uses that information during standby processing to detect lost writes. `FULL` also includes reads from read-only tablespaces on the primary. `NONE` disables this detection mechanism.
The important point is that the primary generally records the information, while the standby or media recovery process performs the comparison and detects the lost write. This makes `DB_LOST_WRITE_PROTECT` particularly relevant when Oracle Data Guard or media recovery is part of the protection design.
AUTO
When this parameter is set to AUTO on a primary database, the instance automatically decides whether it logs buffer cache reads in the redo log or not, depending on the status of the standby databases.
Specifically, the primary database only logs buffer cache reads if physical standby databases with real time redo apply exist.
When this parameter is set to AUTO on a standby database, the instance will automatically decide whether it incurs additional performance overhead to perform lost write detection or not, depending on whether apply is keeping up.
If apply lag is beyond the reasonable threshold, the standby database will skip lost write protection temporarily until redo apply catches up with primary again, to ensure the lowest Data Guard role transition timings.
Which one should you use?
They should not be viewed as competing settings. If the database uses Data Guard, `DB_LOST_WRITE_PROTECT` provides a standby-based detection mechanism. Shadow Lost Write Protection provides a separate, local SCN-tracking mechanism and can be applied selectively to important tablespaces or data files.
A database protection strategy may use both, provided the operational and performance implications have been tested. However, do not assume that enabling Shadow Lost Write Protection makes `DB_LOST_WRITE_PROTECT` unnecessary, or that setting `DB_LOST_WRITE_PROTECT` creates a shadow tablespace. They are configured, monitored, and operationally managed independently.
So, there are two features for protection: same problem, different mechanisms.
Shadow Lost Write Protection uses shadow tablespaces;
`DB_LOST_WRITE_PROTECT` uses redo and standby/media-recovery processing.
Note: Validate privileges, compatibility, release-specific syntax, and recovery procedures in a test environment before applying this configuration to production.
References
https://docs.oracle.com/en/database/oracle/oracle-database/18/admin/managing-tablespaces.html
https://docs.oracle.com/en/database/oracle/oracle-database/26/haovw/ha-unplanned-downtime.html
https://docs.oracle.com/en/error-help/db/ora-65478/?r=26ai
https://docs.oracle.com/en/database/oracle/oracle-database/19/refrn/DB_LOST_WRITE_PROTECT.html
Alireza Kamrani
Infrastructure & Data platform leader |ACE Pro
