Writing audit records to Windows Event Log failed_ora-28036 writing audit records to windows event l-优快云博客

ORA-28056：Writing audit records to Windows Event Log failed

今天同事遇到这个问题。表面现象是，odbc无法连接。
不过我检查问题，首先会去检查Oracle相关的一些情况，比如说：监听有没有启动、数据库服务有没有起来、tnsnames.ora配置是否正确、用sqlplus或plsql dev是否可以连接。这些排除后，再检查是否是应用的问题。
所以，按照这个步骤，我先用sqlplus去连接了下，发现此问题。
看意思是Oracle写审计日志到windows事件日志记录失败。对此我的第一反应是：是不是日志写满了，写不下了。所以我想去找它会把日志写到哪里，但是无从下手，因为没给目录呀～～。这是常规的思维习惯，思路其实是正确的，但是没有联想到windows事件查看器。直到google了下，才发现。将同事的事件日志一删除，立马就可以了。这个是windows应用记录事件日志的地方，限制了记录的最大事件数，超过了就写不下了。
不过，这个问题，根据网上发生报错的情况，和同事的情况都有个共性：都是11g。
应该是11g新增的功能所致，可能需要把这个停掉才能避免此类错误再次发生。

错误详细信息：
ORA-28056: Writing audit records to Windows Event Log failed
OSD-2094672: Message 2094672 not found; product=RDBMS; facility=SOSD
O/S-Error: (OS 1502) ??????????????????
ORA-28056: Writing audit records to Windows Event Log failed
OSD-2094672: Message 2094672 not found; product=RDBMS; facility=SOSD
O/S-Error: (OS 1502) ??????????????????

这是网上参考的解决方案：
Subject: Connect As Sysdba Fails With ORA-28056
Doc ID: 784068.1 Type: PROBLEM
Modified Date: 20-MAR-2009 Status: MODERATED

Applies to:
OracleServer- Personal Edition - Version: 11.1.0.6 to 11.1.0.7
This problem can occur on any platform.

Symptoms

connect as sysdba fails with:
ORA-28056: Writing audit records to Windows Event Log failed.

Cause
Event Viewer log is full and not able to log anymore events.

Justified by unpublished Bug.6823281 ORA-28056 WRITING AUDIT RECORDS TO WINDOWS EVENT LOG FAILED

which was closed as not a bug.

Solution
Try doing the following using Event Viewer:
.
To open Event Viewer, click Start, click Control Panel,
click Performance and Maintenance, click Administrative Tools,
and then double-click Event Viewer.
.
You must be logged on as an administrator or a member of the
Administrators group to free an event log.
.
1) When a log is full, it stops recording new events. Clearing the log
is one way to free the log and start recording new events.
.
2) You can also free a log and start recording new events by overwriting
old events. To overwrite events, on the Action menu, click Properties,
and then click Overwrite events as needed. This ensures that all new
events are written to the log, even when the log is full.
.
3) You can also start logging new events by increasing the maximum
log size. To increase the log size, on the Action menu, click Properties,
and then increase the Maximum log size.

其实在这种情况后面，如果大家的问题还没有解决的话，可以继续参照下文，继续处理就可以了

Writing audit records to Windows Event Log failed