Ora 28056 writing audit records to windows event log failed

Hi community,

we are experiancing an issue during RMAN Table recovery on Windows hosts. The error message sounds like:

RMAN-00571: ===========================================================

RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============

RMAN-00571: ===========================================================

RMAN-03002: failure of recover command at 02/28/2017 09:04:31

RMAN-04006: error from auxiliary database: ORA-28056: Writing audit records to Windows Event Log failed

ORA-28056: Writing audit records to Windows Event Log failed

Test Steps:

• Create File location C:disk1 and C:disk2 on the host
• Connect to RMAN and take full db backup:

          rman target /

          RUN

        {

          ALLOCATE CHANNEL disk1 DEVICE TYPE DISK FORMAT ‘/disk1/%d_FULLDB_%T_%u_s%s_p%p’;

          ALLOCATE CHANNEL disk2 DEVICE TYPE DISK FORMAT ‘/disk2/%d_FULLDB_%T_%u_s%s_p%p’;

          CONFIGURE CONTROLFILE AUTOBACKUP ON;

          BACKUP AS COMPRESSED BACKUPSET TAG=»FULLDB_BACKUP» DATABASE PLUS ARCHIVELOG TAG=» FULLDB_BACKUP»;

          RELEASE CHANNEL disk1;

          RELEASE CHANNEL disk2;

        }

• Check SCN

          select dbms_flashback.get_system_change_number SCN ,to_char(sysdate,’DD-MON-YYYY HH24:MI:SS’) «CURRENT TIMESTAMP» from dual;

• DROP a Table

           DROP table test;

• Try to recover the table until SCN from above (before the drop table)

          recover table <Schema>.test until scn <SCN from above> auxiliary destination ‘C:disk1’;

Environment:

I’ve tested the same on Windows Server 2012 (64-bit) and on Windows Server 2016 (64-bit). The result was the same on both Windows machines.

Solution already tried:

I’ve already googled for a solution to this issue but everything in the net is pointing to clearing the Windows Application Log. I did that, although the the logfile haven’t even reached it’s max size.

So clearing the log doesn’t solve my issue.

Other Information:

We are using Oracle 12.1.0.2 EE. The above steps are working fine on the same version of Oracle running on a RHEL OS.

Can you please help me in solving this issue?

Thanks and BR

Chris

I am trying to recover a table using by RMAN but I am getting the below issue

Database version : 12.2.0.1.0

OS : Windows 10

Error :

RMAN> RECOVER TABLE TBSPIR.’TEST’
2> UNTIL time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”
3> AUXILIARY DESTINATION ‘C:apptbspir’
4> REMAP TABLE ‘TBSPIR’.’TEST’:’TEST_PREV’;

RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of recover command at 07/16/2019 11:16:42
RMAN-04006: error from auxiliary database: ORA-28056: Writing audit records to Windows Event Log failed
OSD-32762: Message 32762 not found; product=RDBMS; facility=SOSD
ORA-28056: Writing audit records to Windows Event Log failed
OSD-32762: Message 32762 not found; product=RDBMS; facility=SOSD

O/S-Error: (OS 2) The system cannot find the file specified.

Solution :

I tried to clear the Event log also from Event viewer but still I am getting the error.

I checked the Administrative events logs, it says

“RegOpenKeyExW(-2147483646,SYSTEMCurrentControlSetServicesVSSDiag,…)
0x80070005, Access is denied.
Operation: Initializing Writer Context: Writer Class Id: {26d02976-b909-43ad-af7e-62a4f625e372} Writer Name: Oracle VSS Writer – AUDITDB Writer Instance Name: AUDITDB Writer Instance ID: {14455cba-5261-40a8-ac65-523b293f70a3}
2D20436F64653A20524547524547534330303030303135342D2043616C6C3A20524547524547534330303030303132372D205049443A202030303030383338382D205449443A202030303031333033322D20434D443A2020633A5C6170705C6F7261636C655C70726F647563745C31322E322E305C6462686F6D655F315C62696E5C4F7261565353572E65786520415544495444422020202D20557365723A204E616D653A204C542D30312D30392D3939354538355C6F7261636C652C205349443A532D312D352D32312D343130383139383137352D323935333532383932312D323739333936353832302D31303032 ”

The Oracle services are running by Oracle os user. this user doesn’t have administrative privilege So I decided to run the Oracle Services by Local Account.

Shutdown the database

Start the services as below

After I started the database service, Now I can able to recover the table

RMAN> RECOVER TABLE TBSPIR.’TEST’
2> UNTIL time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”
3> AUXILIARY DESTINATION ‘C:apptbspir’
4> REMAP TABLE ‘TBSPIR’.’TEST’:’TEST_PREV’;

Starting recover at 16-JUL-19
using channel ORA_DISK_1
RMAN-05026: warning: presuming following set of tablespaces applies to specified point-in-time

List of tablespaces expected to have UNDO segments
Tablespace SYSTEM
Tablespace UNDOTBS1

Creating automatic instance, with SID=’atch’

initialization parameters used for automatic instance:
db_name=AUDITDB
db_unique_name=atch_pitr_AUDITDB
compatible=12.2.0
db_block_size=8192
db_files=200
diagnostic_dest=C:APPORACLE
_system_trig_enabled=FALSE
sga_target=4880M
processes=200
db_create_file_dest=C:apptbspir
log_archive_dest_1=’location=C:apptbspir’
#No auxiliary parameter file used

starting up automatic instance AUDITDB

Oracle instance started

Total System Global Area 5117050880 bytes

Fixed Size 8757424 bytes
Variable Size 989859664 bytes
Database Buffers 4110417920 bytes
Redo Buffers 8015872 bytes
Automatic instance created

contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# restore the controlfile
restore clone controlfile;

# mount the controlfile
sql clone ‘alter database mount clone database’;

# archive current online log
sql ‘alter system archive log current’;
}
executing Memory Script

executing command: SET until clause

Starting restore at 16-JUL-19
allocated channel: ORA_AUX_DISK_1
channel ORA_AUX_DISK_1: SID=5 device type=DISK

channel ORA_AUX_DISK_1: starting datafile backup set restore
channel ORA_AUX_DISK_1: restoring control file
channel ORA_AUX_DISK_1: reading from backup piece C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBAUTOBACKUP2019_07_14O1_MF_S_1013609684_GLP3O4QD_.BKP
channel ORA_AUX_DISK_1: piece handle=C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBAUTOBACKUP2019_07_14O1_MF_S_1013609684_GLP3O4QD_.BKP tag=TAG20190714T141444
channel ORA_AUX_DISK_1: restored backup piece 1
channel ORA_AUX_DISK_1: restore complete, elapsed time: 00:00:01
output file name=C:APPTBSPIRAUDITDBCONTROLFILEO1_MF_GLVBVD9W_.CTL
Finished restore at 16-JUL-19

sql statement: alter database mount clone database

sql statement: alter system archive log current

contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# set destinations for recovery set and auxiliary set datafiles
set newname for clone datafile 1 to new;
set newname for clone datafile 5 to new;
set newname for clone datafile 3 to new;
set newname for clone tempfile 1 to new;
# switch all tempfiles
switch clone tempfile all;
# restore the tablespaces in the recovery set and the auxiliary set
restore clone datafile 1, 5, 3;

switch clone datafile all;
}
executing Memory Script

executing command: SET until clause

executing command: SET NEWNAME

executing command: SET NEWNAME

executing command: SET NEWNAME

executing command: SET NEWNAME

renamed tempfile 1 to C:APPTBSPIRAUDITDBDATAFILEO1_MF_TEMP_%U_.TMP in control file

Starting restore at 16-JUL-19
using channel ORA_AUX_DISK_1

channel ORA_AUX_DISK_1: starting datafile backup set restore
channel ORA_AUX_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_AUX_DISK_1: restoring datafile 00001 to C:APPTBSPIRAUDITDBDATAFILEO1_MF_SYSTEM_%U_.DBF
channel ORA_AUX_DISK_1: restoring datafile 00005 to C:APPTBSPIRAUDITDBDATAFILEO1_MF_UNDOTBS1_%U_.DBF
channel ORA_AUX_DISK_1: restoring datafile 00003 to C:APPTBSPIRAUDITDBDATAFILEO1_MF_SYSAUX_%U_.DBF
channel ORA_AUX_DISK_1: reading from backup piece C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBBACKUPSET2019_07_14O1_MF_NNNDF_TAG20190714T141427_GLP3NMT4_.BKP
channel ORA_AUX_DISK_1: piece handle=C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBBACKUPSET2019_07_14O1_MF_NNNDF_TAG20190714T141427_GLP3NMT4_.BKP tag=TAG20190714T141427
channel ORA_AUX_DISK_1: restored backup piece 1
channel ORA_AUX_DISK_1: restore complete, elapsed time: 00:00:15
Finished restore at 16-JUL-19

datafile 1 switched to datafile copy
input datafile copy RECID=4 STAMP=1013780914 file name=C:APPTBSPIRAUDITDBDATAFILEO1_MF_SYSTEM_GLVBVLX5_.DBF
datafile 5 switched to datafile copy
input datafile copy RECID=5 STAMP=1013780914 file name=C:APPTBSPIRAUDITDBDATAFILEO1_MF_UNDOTBS1_GLVBVLXR_.DBF
datafile 3 switched to datafile copy
input datafile copy RECID=6 STAMP=1013780914 file name=C:APPTBSPIRAUDITDBDATAFILEO1_MF_SYSAUX_GLVBVLXJ_.DBF

contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# online the datafiles restored or switched
sql clone “alter database datafile 1 online”;
sql clone “alter database datafile 5 online”;
sql clone “alter database datafile 3 online”;
# recover and open database read only
recover clone database tablespace “SYSTEM”, “UNDOTBS1”, “SYSAUX”;
sql clone ‘alter database open read only’;
}
executing Memory Script

executing command: SET until clause

sql statement: alter database datafile 1 online

sql statement: alter database datafile 5 online

sql statement: alter database datafile 3 online

Starting recover at 16-JUL-19
using channel ORA_AUX_DISK_1

starting media recovery

archived log for thread 1 with sequence 84 is already on disk as file C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBARCHIVELOG2019_07_14O1_MF_1_84_GLP3O30R_.ARC
archived log for thread 1 with sequence 85 is already on disk as file C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBARCHIVELOG2019_07_14O1_MF_1_85_GLP4HM4Y_.ARC
archived log file name=C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBARCHIVELOG2019_07_14O1_MF_1_84_GLP3O30R_.ARC thread=1 sequence=84
archived log file name=C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBARCHIVELOG2019_07_14O1_MF_1_85_GLP4HM4Y_.ARC thread=1 sequence=85
media recovery complete, elapsed time: 00:00:00
Finished recover at 16-JUL-19

sql statement: alter database open read only

contents of Memory Script:
{
sql clone “create spfile from memory”;
shutdown clone immediate;
startup clone nomount;
sql clone “alter system set control_files =
”C:APPTBSPIRAUDITDBCONTROLFILEO1_MF_GLVBVD9W_.CTL” comment=
”RMAN set” scope=spfile”;
shutdown clone immediate;
startup clone nomount;
# mount database
sql clone ‘alter database mount clone database’;
}
executing Memory Script

sql statement: create spfile from memory

database closed
database dismounted
Oracle instance shut down

connected to auxiliary database (not started)
Oracle instance started

Total System Global Area 5117050880 bytes

Fixed Size 8757424 bytes
Variable Size 989859664 bytes
Database Buffers 4110417920 bytes
Redo Buffers 8015872 bytes

sql statement: alter system set control_files = ”C:APPTBSPIRAUDITDBCONTROLFILEO1_MF_GLVBVD9W_.CTL” comment= ”RMAN set” scope=spfile

Oracle instance shut down

connected to auxiliary database (not started)
Oracle instance started

Total System Global Area 5117050880 bytes

Fixed Size 8757424 bytes
Variable Size 989859664 bytes
Database Buffers 4110417920 bytes
Redo Buffers 8015872 bytes

sql statement: alter database mount clone database

contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# set destinations for recovery set and auxiliary set datafiles
set newname for datafile 7 to new;
# restore the tablespaces in the recovery set and the auxiliary set
restore clone datafile 7;

switch clone datafile all;
}
executing Memory Script

executing command: SET until clause

executing command: SET NEWNAME

Starting restore at 16-JUL-19
allocated channel: ORA_AUX_DISK_1
channel ORA_AUX_DISK_1: SID=5 device type=DISK

channel ORA_AUX_DISK_1: starting datafile backup set restore
channel ORA_AUX_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_AUX_DISK_1: restoring datafile 00007 to C:APPTBSPIRATCH_PITR_AUDITDBDATAFILEO1_MF_USERS_%U_.DBF
channel ORA_AUX_DISK_1: reading from backup piece C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBBACKUPSET2019_07_14O1_MF_NNNDF_TAG20190714T141427_GLP3NMT4_.BKP
channel ORA_AUX_DISK_1: piece handle=C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBBACKUPSET2019_07_14O1_MF_NNNDF_TAG20190714T141427_GLP3NMT4_.BKP tag=TAG20190714T141427
channel ORA_AUX_DISK_1: restored backup piece 1
channel ORA_AUX_DISK_1: restore complete, elapsed time: 00:00:01
Finished restore at 16-JUL-19

datafile 7 switched to datafile copy
input datafile copy RECID=8 STAMP=1013781058 file name=C:APPTBSPIRATCH_PITR_AUDITDBDATAFILEO1_MF_USERS_GLVC0KJR_.DBF

contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# online the datafiles restored or switched
sql clone “alter database datafile 7 online”;
# recover and open resetlogs
recover clone database tablespace “USERS”, “SYSTEM”, “UNDOTBS1”, “SYSAUX” delete archivelog;
alter clone database open resetlogs;
}
executing Memory Script

executing command: SET until clause

sql statement: alter database datafile 7 online

Starting recover at 16-JUL-19
using channel ORA_AUX_DISK_1

starting media recovery

archived log for thread 1 with sequence 84 is already on disk as file C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBARCHIVELOG2019_07_14O1_MF_1_84_GLP3O30R_.ARC
archived log for thread 1 with sequence 85 is already on disk as file C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBARCHIVELOG2019_07_14O1_MF_1_85_GLP4HM4Y_.ARC
archived log file name=C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBARCHIVELOG2019_07_14O1_MF_1_84_GLP3O30R_.ARC thread=1 sequence=84
archived log file name=C:APPORACLEFAST_RECOVERY_AREAAUDITDBAUDITDBARCHIVELOG2019_07_14O1_MF_1_85_GLP4HM4Y_.ARC thread=1 sequence=85
media recovery complete, elapsed time: 00:00:00
Finished recover at 16-JUL-19

database opened

contents of Memory Script:
{
# create directory for datapump import
sql “create or replace directory TSPITR_DIROBJ_DPDIR as ”
C:apptbspir””;
# create directory for datapump export
sql clone “create or replace directory TSPITR_DIROBJ_DPDIR as ”
C:apptbspir””;
}
executing Memory Script

sql statement: create or replace directory TSPITR_DIROBJ_DPDIR as ”C:apptbspir”

sql statement: create or replace directory TSPITR_DIROBJ_DPDIR as ”C:apptbspir”

Performing export of tables…
EXPDP> Starting “SYS”.”TSPITR_EXP_atch_pkgA”:
EXPDP> Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
EXPDP> Processing object type TABLE_EXPORT/TABLE/STATISTICS/TABLE_STATISTICS
EXPDP> Processing object type TABLE_EXPORT/TABLE/TABLE
EXPDP> . . exported “TBSPIR”.”TEST” 5.148 KB 10 rows
EXPDP> Master table “SYS”.”TSPITR_EXP_atch_pkgA” successfully loaded/unloaded
EXPDP> ******************************************************************************
EXPDP> Dump file set for SYS.TSPITR_EXP_atch_pkgA is:
EXPDP> C:APPTBSPIRTSPITR_ATCH_90840.DMP
EXPDP> Job “SYS”.”TSPITR_EXP_atch_pkgA” successfully completed at Tue Jul 16 13:51:38 2019 elapsed 0 00:00:22
Export completed

contents of Memory Script:
{
# shutdown clone before import
shutdown clone abort
}
executing Memory Script

Oracle instance shut down

Performing import of tables…
IMPDP> Master table “SYS”.”TSPITR_IMP_atch_ygqm” successfully loaded/unloaded
IMPDP> Starting “SYS”.”TSPITR_IMP_atch_ygqm”:
IMPDP> Processing object type TABLE_EXPORT/TABLE/TABLE
IMPDP> Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
IMPDP> . . imported “TBSPIR”.”TEST_PREV” 5.148 KB 10 rows
IMPDP> Processing object type TABLE_EXPORT/TABLE/STATISTICS/TABLE_STATISTICS
IMPDP> Job “SYS”.”TSPITR_IMP_atch_ygqm” successfully completed at Tue Jul 16 13:51:55 2019 elapsed 0 00:00:02
Import completed

Removing automatic instance
Automatic instance removed
auxiliary instance file C:APPTBSPIRAUDITDBDATAFILEO1_MF_TEMP_GLVBW55J_.TMP deleted
auxiliary instance file C:APPTBSPIRATCH_PITR_AUDITDBONLINELOGO1_MF_3_GLVC0OC4_.LOG deleted
auxiliary instance file C:APPTBSPIRATCH_PITR_AUDITDBONLINELOGO1_MF_2_GLVC0O8G_.LOG deleted
auxiliary instance file C:APPTBSPIRATCH_PITR_AUDITDBONLINELOGO1_MF_1_GLVC0O6O_.LOG deleted
auxiliary instance file C:APPTBSPIRATCH_PITR_AUDITDBDATAFILEO1_MF_USERS_GLVC0KJR_.DBF deleted
auxiliary instance file C:APPTBSPIRAUDITDBDATAFILEO1_MF_SYSAUX_GLVBVLXJ_.DBF deleted
auxiliary instance file C:APPTBSPIRAUDITDBDATAFILEO1_MF_UNDOTBS1_GLVBVLXR_.DBF deleted
auxiliary instance file C:APPTBSPIRAUDITDBDATAFILEO1_MF_SYSTEM_GLVBVLX5_.DBF deleted
auxiliary instance file C:APPTBSPIRAUDITDBCONTROLFILEO1_MF_GLVBVD9W_.CTL deleted
auxiliary instance file tspitr_atch_90840.dmp deleted
Finished recover at 16-JUL-19

RMAN>

SQL> select * from tbspir.test_prev;

EMPLOYEE
——————–
xxxx
yyyy
zzzz
wwww
vvvvv
u
ttttt
sssss
rrrr
qqqqq

10 rows selected.

This Problem occurs when we are trying to connect as sysdba. This error may occur at anytime when there Event Viewer log become full. In my case it occurs when connecting with sys user as sysdba privilage  and once while creating the database(through dbca when it has completed 85% ).

C:> sqlplus sys/xxxx@noida as sysdba

ORA-28056: Writing audit records to Windows Event Log failed.

Cause of the Problem : The problem happened because Event Viewer log is full and not able to log anymore events.

Solution of the Problem :  This was because the Event Viewer log is full and could not log anymore events.

The solution is to clear the event log .To solve this issue follow any of the following steps.

1) When a log is full, it stops recording new events. Clearing the log is one way to free the log and start recording new events. To do so, on the Action menu (left click)or on the left side Application/System/Security (as available) right click and select Clear All events.

2) We can also free a log and start recording new events by overwriting old events. To overwrite events, on the Action menu, or on the left side Application/System/Security (as available) click Properties, and then click Overwrite events as needed. This ensures that all new events are written to the log, even when the log is full. 

3) We can also start logging new events by increasing the maximum log size. To increase the log size, on the Action menu or on the left side Application/System/Security (as available) click Properties, and then increase the Maximum log size by typing a bigger value.

Enjoy  

I got a PC which ran out from disk space & Oracle was not working. The error was ORA-28056.

I need to delete all the event log & then reconnect it again. Here you can see what happened & it get resolved.

Your suggestions and queries are always warm welcomed.

Problem Description
Connecting as sysdba fails with ORA-28056.

$ sqlplus / as sysdba
ORA-28056: Writing audit records to Windows Event Log failed.

Cause of the Problem
The problem happened because Event Viewer log is full and not able to log anymore events.

Solution of the Problem
You need to free an event log.

— Log in as a administrator or a member of the Administrators group in order to free an event log.

— Open Event Viewer. To do so click on Start Menu, click Control Panel, click Performance and Maintenance, click Administrative Tools, and then double-click Event Viewer.

Or, click on Start Menu, click Control Panel, click Administrative Tools, and then double-click Event Viewer.

— Now you can follow any of the following steps.

1) When a log is full, it stops recording new events. Clearing the log is one way to free the log and start recording new events. To do so, on the Action menu (left click)or on the left side Application/System/Security (as available) right click and select Clear All events.

2) You can also free a log and start recording new events by overwriting old events. To overwrite events, on the Action menu, or on the left side Application/System/Security (as available) click Properties, and then click Overwrite events as needed. This ensures that all new events are written to the log, even when the log is full.

3) You can also start logging new events by increasing the maximum log size. To increase the log size, on the Action menu or on the left side Application/System/Security (as available) click Properties, and then increase the Maximum log size by typing a bigger value.