ORA-28056: Writing audit records to Windows Event Log failed
I am trying to recover a table using by RMAN but I am getting the below issue
Database version : 12.2.0.1.0
OS : Windows 10
Error :
RMAN> RECOVER TABLE TBSPIR.’TEST’
2> UNTIL time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”
3> AUXILIARY DESTINATION ‘C:\app\tbspir’
4> REMAP TABLE ‘TBSPIR’.’TEST’:’TEST_PREV’;
RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of recover command at 07/16/2019 11:16:42
RMAN-04006: error from auxiliary database: ORA-28056: Writing audit records to Windows Event Log failed
OSD-32762: Message 32762 not found; product=RDBMS; facility=SOSD
ORA-28056: Writing audit records to Windows Event Log failed
OSD-32762: Message 32762 not found; product=RDBMS; facility=SOSD
O/S-Error: (OS 2) The system cannot find the file specified.
Solution :
I tried to clear the Event log also from Event viewer but still I am getting the error.
I checked the Administrative events logs, it says
“RegOpenKeyExW(-2147483646,SYSTEM\CurrentControlSet\Services\VSS\Diag,…)
0x80070005, Access is denied.
Operation: Initializing Writer Context: Writer Class Id: {26d02976-b909-43ad-af7e-62a4f625e372} Writer Name: Oracle VSS Writer – AUDITDB Writer Instance Name: AUDITDB Writer Instance ID: {14455cba-5261-40a8-ac65-523b293f70a3}
2D20436F64653A20524547524547534330303030303135342D2043616C6C3A20524547524547534330303030303132372D205049443A202030303030383338382D205449443A202030303031333033322D20434D443A2020633A5C6170705C6F7261636C655C70726F647563745C31322E322E305C6462686F6D655F315C62696E5C4F7261565353572E65786520415544495444422020202D20557365723A204E616D653A204C542D30312D30392D3939354538355C6F7261636C652C205349443A532D312D352D32312D343130383139383137352D323935333532383932312D323739333936353832302D31303032 ”
The Oracle services are running by Oracle os user. this user doesn’t have administrative privilege So I decided to run the Oracle Services by Local Account.
Shutdown the database
Start the services as below
After I started the database service, Now I can able to recover the table
RMAN> RECOVER TABLE TBSPIR.’TEST’
2> UNTIL time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”
3> AUXILIARY DESTINATION ‘C:\app\tbspir’
4> REMAP TABLE ‘TBSPIR’.’TEST’:’TEST_PREV’;
Starting recover at 16-JUL-19
using channel ORA_DISK_1
RMAN-05026: warning: presuming following set of tablespaces applies to specified point-in-time
List of tablespaces expected to have UNDO segments
Tablespace SYSTEM
Tablespace UNDOTBS1
Creating automatic instance, with SID=’atch’
initialization parameters used for automatic instance:
db_name=AUDITDB
db_unique_name=atch_pitr_AUDITDB
compatible=12.2.0
db_block_size=8192
db_files=200
diagnostic_dest=C:\APP\ORACLE
_system_trig_enabled=FALSE
sga_target=4880M
processes=200
db_create_file_dest=C:\app\tbspir
log_archive_dest_1=’location=C:\app\tbspir’
#No auxiliary parameter file used
starting up automatic instance AUDITDB
Oracle instance started
Total System Global Area 5117050880 bytes
Fixed Size 8757424 bytes
Variable Size 989859664 bytes
Database Buffers 4110417920 bytes
Redo Buffers 8015872 bytes
Automatic instance created
contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# restore the controlfile
restore clone controlfile;
# mount the controlfile
sql clone ‘alter database mount clone database’;
# archive current online log
sql ‘alter system archive log current’;
}
executing Memory Script
executing command: SET until clause
Starting restore at 16-JUL-19
allocated channel: ORA_AUX_DISK_1
channel ORA_AUX_DISK_1: SID=5 device type=DISK
channel ORA_AUX_DISK_1: starting datafile backup set restore
channel ORA_AUX_DISK_1: restoring control file
channel ORA_AUX_DISK_1: reading from backup piece C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\AUTOBACKUP\2019_07_14\O1_MF_S_1013609684_GLP3O4QD_.BKP
channel ORA_AUX_DISK_1: piece handle=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\AUTOBACKUP\2019_07_14\O1_MF_S_1013609684_GLP3O4QD_.BKP tag=TAG20190714T141444
channel ORA_AUX_DISK_1: restored backup piece 1
channel ORA_AUX_DISK_1: restore complete, elapsed time: 00:00:01
output file name=C:\APP\TBSPIR\AUDITDB\CONTROLFILE\O1_MF_GLVBVD9W_.CTL
Finished restore at 16-JUL-19
sql statement: alter database mount clone database
sql statement: alter system archive log current
contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# set destinations for recovery set and auxiliary set datafiles
set newname for clone datafile 1 to new;
set newname for clone datafile 5 to new;
set newname for clone datafile 3 to new;
set newname for clone tempfile 1 to new;
# switch all tempfiles
switch clone tempfile all;
# restore the tablespaces in the recovery set and the auxiliary set
restore clone datafile 1, 5, 3;
switch clone datafile all;
}
executing Memory Script
executing command: SET until clause
executing command: SET NEWNAME
executing command: SET NEWNAME
executing command: SET NEWNAME
executing command: SET NEWNAME
renamed tempfile 1 to C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_TEMP_%U_.TMP in control file
Starting restore at 16-JUL-19
using channel ORA_AUX_DISK_1
channel ORA_AUX_DISK_1: starting datafile backup set restore
channel ORA_AUX_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_AUX_DISK_1: restoring datafile 00001 to C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_SYSTEM_%U_.DBF
channel ORA_AUX_DISK_1: restoring datafile 00005 to C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_UNDOTBS1_%U_.DBF
channel ORA_AUX_DISK_1: restoring datafile 00003 to C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_SYSAUX_%U_.DBF
channel ORA_AUX_DISK_1: reading from backup piece C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\BACKUPSET\2019_07_14\O1_MF_NNNDF_TAG20190714T141427_GLP3NMT4_.BKP
channel ORA_AUX_DISK_1: piece handle=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\BACKUPSET\2019_07_14\O1_MF_NNNDF_TAG20190714T141427_GLP3NMT4_.BKP tag=TAG20190714T141427
channel ORA_AUX_DISK_1: restored backup piece 1
channel ORA_AUX_DISK_1: restore complete, elapsed time: 00:00:15
Finished restore at 16-JUL-19
datafile 1 switched to datafile copy
input datafile copy RECID=4 STAMP=1013780914 file name=C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_SYSTEM_GLVBVLX5_.DBF
datafile 5 switched to datafile copy
input datafile copy RECID=5 STAMP=1013780914 file name=C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_UNDOTBS1_GLVBVLXR_.DBF
datafile 3 switched to datafile copy
input datafile copy RECID=6 STAMP=1013780914 file name=C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_SYSAUX_GLVBVLXJ_.DBF
contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# online the datafiles restored or switched
sql clone “alter database datafile 1 online”;
sql clone “alter database datafile 5 online”;
sql clone “alter database datafile 3 online”;
# recover and open database read only
recover clone database tablespace “SYSTEM”, “UNDOTBS1”, “SYSAUX”;
sql clone ‘alter database open read only’;
}
executing Memory Script
executing command: SET until clause
sql statement: alter database datafile 1 online
sql statement: alter database datafile 5 online
sql statement: alter database datafile 3 online
Starting recover at 16-JUL-19
using channel ORA_AUX_DISK_1
starting media recovery
archived log for thread 1 with sequence 84 is already on disk as file C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_84_GLP3O30R_.ARC
archived log for thread 1 with sequence 85 is already on disk as file C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_85_GLP4HM4Y_.ARC
archived log file name=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_84_GLP3O30R_.ARC thread=1 sequence=84
archived log file name=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_85_GLP4HM4Y_.ARC thread=1 sequence=85
media recovery complete, elapsed time: 00:00:00
Finished recover at 16-JUL-19
sql statement: alter database open read only
contents of Memory Script:
{
sql clone “create spfile from memory”;
shutdown clone immediate;
startup clone nomount;
sql clone “alter system set control_files =
”C:\APP\TBSPIR\AUDITDB\CONTROLFILE\O1_MF_GLVBVD9W_.CTL” comment=
”RMAN set” scope=spfile”;
shutdown clone immediate;
startup clone nomount;
# mount database
sql clone ‘alter database mount clone database’;
}
executing Memory Script
sql statement: create spfile from memory
database closed
database dismounted
Oracle instance shut down
connected to auxiliary database (not started)
Oracle instance started
Total System Global Area 5117050880 bytes
Fixed Size 8757424 bytes
Variable Size 989859664 bytes
Database Buffers 4110417920 bytes
Redo Buffers 8015872 bytes
sql statement: alter system set control_files = ”C:\APP\TBSPIR\AUDITDB\CONTROLFILE\O1_MF_GLVBVD9W_.CTL” comment= ”RMAN set” scope=spfile
Oracle instance shut down
connected to auxiliary database (not started)
Oracle instance started
Total System Global Area 5117050880 bytes
Fixed Size 8757424 bytes
Variable Size 989859664 bytes
Database Buffers 4110417920 bytes
Redo Buffers 8015872 bytes
sql statement: alter database mount clone database
contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# set destinations for recovery set and auxiliary set datafiles
set newname for datafile 7 to new;
# restore the tablespaces in the recovery set and the auxiliary set
restore clone datafile 7;
switch clone datafile all;
}
executing Memory Script
executing command: SET until clause
executing command: SET NEWNAME
Starting restore at 16-JUL-19
allocated channel: ORA_AUX_DISK_1
channel ORA_AUX_DISK_1: SID=5 device type=DISK
channel ORA_AUX_DISK_1: starting datafile backup set restore
channel ORA_AUX_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_AUX_DISK_1: restoring datafile 00007 to C:\APP\TBSPIR\ATCH_PITR_AUDITDB\DATAFILE\O1_MF_USERS_%U_.DBF
channel ORA_AUX_DISK_1: reading from backup piece C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\BACKUPSET\2019_07_14\O1_MF_NNNDF_TAG20190714T141427_GLP3NMT4_.BKP
channel ORA_AUX_DISK_1: piece handle=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\BACKUPSET\2019_07_14\O1_MF_NNNDF_TAG20190714T141427_GLP3NMT4_.BKP tag=TAG20190714T141427
channel ORA_AUX_DISK_1: restored backup piece 1
channel ORA_AUX_DISK_1: restore complete, elapsed time: 00:00:01
Finished restore at 16-JUL-19
datafile 7 switched to datafile copy
input datafile copy RECID=8 STAMP=1013781058 file name=C:\APP\TBSPIR\ATCH_PITR_AUDITDB\DATAFILE\O1_MF_USERS_GLVC0KJR_.DBF
contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# online the datafiles restored or switched
sql clone “alter database datafile 7 online”;
# recover and open resetlogs
recover clone database tablespace “USERS”, “SYSTEM”, “UNDOTBS1”, “SYSAUX” delete archivelog;
alter clone database open resetlogs;
}
executing Memory Script
executing command: SET until clause
sql statement: alter database datafile 7 online
Starting recover at 16-JUL-19
using channel ORA_AUX_DISK_1
starting media recovery
archived log for thread 1 with sequence 84 is already on disk as file C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_84_GLP3O30R_.ARC
archived log for thread 1 with sequence 85 is already on disk as file C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_85_GLP4HM4Y_.ARC
archived log file name=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_84_GLP3O30R_.ARC thread=1 sequence=84
archived log file name=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_85_GLP4HM4Y_.ARC thread=1 sequence=85
media recovery complete, elapsed time: 00:00:00
Finished recover at 16-JUL-19
database opened
contents of Memory Script:
{
# create directory for datapump import
sql “create or replace directory TSPITR_DIROBJ_DPDIR as ”
C:\app\tbspir””;
# create directory for datapump export
sql clone “create or replace directory TSPITR_DIROBJ_DPDIR as ”
C:\app\tbspir””;
}
executing Memory Script
sql statement: create or replace directory TSPITR_DIROBJ_DPDIR as ”C:\app\tbspir”
sql statement: create or replace directory TSPITR_DIROBJ_DPDIR as ”C:\app\tbspir”
Performing export of tables…
EXPDP> Starting “SYS”.”TSPITR_EXP_atch_pkgA”:
EXPDP> Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
EXPDP> Processing object type TABLE_EXPORT/TABLE/STATISTICS/TABLE_STATISTICS
EXPDP> Processing object type TABLE_EXPORT/TABLE/TABLE
EXPDP> . . exported “TBSPIR”.”TEST” 5.148 KB 10 rows
EXPDP> Master table “SYS”.”TSPITR_EXP_atch_pkgA” successfully loaded/unloaded
EXPDP> ******************************************************************************
EXPDP> Dump file set for SYS.TSPITR_EXP_atch_pkgA is:
EXPDP> C:\APP\TBSPIR\TSPITR_ATCH_90840.DMP
EXPDP> Job “SYS”.”TSPITR_EXP_atch_pkgA” successfully completed at Tue Jul 16 13:51:38 2019 elapsed 0 00:00:22
Export completed
contents of Memory Script:
{
# shutdown clone before import
shutdown clone abort
}
executing Memory Script
Oracle instance shut down
Performing import of tables…
IMPDP> Master table “SYS”.”TSPITR_IMP_atch_ygqm” successfully loaded/unloaded
IMPDP> Starting “SYS”.”TSPITR_IMP_atch_ygqm”:
IMPDP> Processing object type TABLE_EXPORT/TABLE/TABLE
IMPDP> Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
IMPDP> . . imported “TBSPIR”.”TEST_PREV” 5.148 KB 10 rows
IMPDP> Processing object type TABLE_EXPORT/TABLE/STATISTICS/TABLE_STATISTICS
IMPDP> Job “SYS”.”TSPITR_IMP_atch_ygqm” successfully completed at Tue Jul 16 13:51:55 2019 elapsed 0 00:00:02
Import completed
Removing automatic instance
Automatic instance removed
auxiliary instance file C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_TEMP_GLVBW55J_.TMP deleted
auxiliary instance file C:\APP\TBSPIR\ATCH_PITR_AUDITDB\ONLINELOG\O1_MF_3_GLVC0OC4_.LOG deleted
auxiliary instance file C:\APP\TBSPIR\ATCH_PITR_AUDITDB\ONLINELOG\O1_MF_2_GLVC0O8G_.LOG deleted
auxiliary instance file C:\APP\TBSPIR\ATCH_PITR_AUDITDB\ONLINELOG\O1_MF_1_GLVC0O6O_.LOG deleted
auxiliary instance file C:\APP\TBSPIR\ATCH_PITR_AUDITDB\DATAFILE\O1_MF_USERS_GLVC0KJR_.DBF deleted
auxiliary instance file C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_SYSAUX_GLVBVLXJ_.DBF deleted
auxiliary instance file C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_UNDOTBS1_GLVBVLXR_.DBF deleted
auxiliary instance file C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_SYSTEM_GLVBVLX5_.DBF deleted
auxiliary instance file C:\APP\TBSPIR\AUDITDB\CONTROLFILE\O1_MF_GLVBVD9W_.CTL deleted
auxiliary instance file tspitr_atch_90840.dmp deleted
Finished recover at 16-JUL-19
RMAN>
SQL> select * from tbspir.test_prev;
EMPLOYEE
——————–
xxxx
yyyy
zzzz
wwww
vvvvv
u
ttttt
sssss
rrrr
qqqqq
10 rows selected.
DBA 
This is perfect ! you are the only one who posted the working solution for me, which is to start the oracle services with local user instead of oracle OS user.