Skip to content
Advertisements

ORA-28056: Writing audit records to Windows Event Log failed

I am trying to recover a table using by RMAN but I am getting the below issue

Database version : 12.2.0.1.0

OS : Windows 10

Error :

RMAN> RECOVER TABLE TBSPIR.’TEST’
2> UNTIL time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”
3> AUXILIARY DESTINATION ‘C:\app\tbspir’
4> REMAP TABLE ‘TBSPIR’.’TEST’:’TEST_PREV’;

 

RMAN-00571: ===========================================================
RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
RMAN-00571: ===========================================================
RMAN-03002: failure of recover command at 07/16/2019 11:16:42
RMAN-04006: error from auxiliary database: ORA-28056: Writing audit records to Windows Event Log failed
OSD-32762: Message 32762 not found; product=RDBMS; facility=SOSD
ORA-28056: Writing audit records to Windows Event Log failed
OSD-32762: Message 32762 not found; product=RDBMS; facility=SOSD

O/S-Error: (OS 2) The system cannot find the file specified.

 

Solution :

I tried to clear the Event log also from Event viewer but still I am getting the error.

I checked the Administrative events logs, it says

“RegOpenKeyExW(-2147483646,SYSTEM\CurrentControlSet\Services\VSS\Diag,…)
0x80070005, Access is denied.
Operation: Initializing Writer Context: Writer Class Id: {26d02976-b909-43ad-af7e-62a4f625e372} Writer Name: Oracle VSS Writer – AUDITDB Writer Instance Name: AUDITDB Writer Instance ID: {14455cba-5261-40a8-ac65-523b293f70a3}
2D20436F64653A20524547524547534330303030303135342D2043616C6C3A20524547524547534330303030303132372D205049443A202030303030383338382D205449443A202030303031333033322D20434D443A2020633A5C6170705C6F7261636C655C70726F647563745C31322E322E305C6462686F6D655F315C62696E5C4F7261565353572E65786520415544495444422020202D20557365723A204E616D653A204C542D30312D30392D3939354538355C6F7261636C652C205349443A532D312D352D32312D343130383139383137352D323935333532383932312D323739333936353832302D31303032 ”

 

The Oracle services are running by Oracle os user. this user doesn’t have administrative privilege So I decided to run the Oracle Services by Local Account.

Shutdown the database

Start the services as below

After I started the database service, Now I can able to recover the table

 

RMAN> RECOVER TABLE TBSPIR.’TEST’
2> UNTIL time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”
3> AUXILIARY DESTINATION ‘C:\app\tbspir’
4> REMAP TABLE ‘TBSPIR’.’TEST’:’TEST_PREV’;

Starting recover at 16-JUL-19
using channel ORA_DISK_1
RMAN-05026: warning: presuming following set of tablespaces applies to specified point-in-time

List of tablespaces expected to have UNDO segments
Tablespace SYSTEM
Tablespace UNDOTBS1

Creating automatic instance, with SID=’atch’

initialization parameters used for automatic instance:
db_name=AUDITDB
db_unique_name=atch_pitr_AUDITDB
compatible=12.2.0
db_block_size=8192
db_files=200
diagnostic_dest=C:\APP\ORACLE
_system_trig_enabled=FALSE
sga_target=4880M
processes=200
db_create_file_dest=C:\app\tbspir
log_archive_dest_1=’location=C:\app\tbspir’
#No auxiliary parameter file used

starting up automatic instance AUDITDB

Oracle instance started

Total System Global Area 5117050880 bytes

Fixed Size 8757424 bytes
Variable Size 989859664 bytes
Database Buffers 4110417920 bytes
Redo Buffers 8015872 bytes
Automatic instance created

contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# restore the controlfile
restore clone controlfile;

# mount the controlfile
sql clone ‘alter database mount clone database’;

# archive current online log
sql ‘alter system archive log current’;
}
executing Memory Script

executing command: SET until clause

Starting restore at 16-JUL-19
allocated channel: ORA_AUX_DISK_1
channel ORA_AUX_DISK_1: SID=5 device type=DISK

channel ORA_AUX_DISK_1: starting datafile backup set restore
channel ORA_AUX_DISK_1: restoring control file
channel ORA_AUX_DISK_1: reading from backup piece C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\AUTOBACKUP\2019_07_14\O1_MF_S_1013609684_GLP3O4QD_.BKP
channel ORA_AUX_DISK_1: piece handle=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\AUTOBACKUP\2019_07_14\O1_MF_S_1013609684_GLP3O4QD_.BKP tag=TAG20190714T141444
channel ORA_AUX_DISK_1: restored backup piece 1
channel ORA_AUX_DISK_1: restore complete, elapsed time: 00:00:01
output file name=C:\APP\TBSPIR\AUDITDB\CONTROLFILE\O1_MF_GLVBVD9W_.CTL
Finished restore at 16-JUL-19

sql statement: alter database mount clone database

sql statement: alter system archive log current

contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# set destinations for recovery set and auxiliary set datafiles
set newname for clone datafile 1 to new;
set newname for clone datafile 5 to new;
set newname for clone datafile 3 to new;
set newname for clone tempfile 1 to new;
# switch all tempfiles
switch clone tempfile all;
# restore the tablespaces in the recovery set and the auxiliary set
restore clone datafile 1, 5, 3;

switch clone datafile all;
}
executing Memory Script

executing command: SET until clause

executing command: SET NEWNAME

executing command: SET NEWNAME

executing command: SET NEWNAME

executing command: SET NEWNAME

renamed tempfile 1 to C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_TEMP_%U_.TMP in control file

Starting restore at 16-JUL-19
using channel ORA_AUX_DISK_1

channel ORA_AUX_DISK_1: starting datafile backup set restore
channel ORA_AUX_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_AUX_DISK_1: restoring datafile 00001 to C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_SYSTEM_%U_.DBF
channel ORA_AUX_DISK_1: restoring datafile 00005 to C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_UNDOTBS1_%U_.DBF
channel ORA_AUX_DISK_1: restoring datafile 00003 to C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_SYSAUX_%U_.DBF
channel ORA_AUX_DISK_1: reading from backup piece C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\BACKUPSET\2019_07_14\O1_MF_NNNDF_TAG20190714T141427_GLP3NMT4_.BKP
channel ORA_AUX_DISK_1: piece handle=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\BACKUPSET\2019_07_14\O1_MF_NNNDF_TAG20190714T141427_GLP3NMT4_.BKP tag=TAG20190714T141427
channel ORA_AUX_DISK_1: restored backup piece 1
channel ORA_AUX_DISK_1: restore complete, elapsed time: 00:00:15
Finished restore at 16-JUL-19

datafile 1 switched to datafile copy
input datafile copy RECID=4 STAMP=1013780914 file name=C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_SYSTEM_GLVBVLX5_.DBF
datafile 5 switched to datafile copy
input datafile copy RECID=5 STAMP=1013780914 file name=C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_UNDOTBS1_GLVBVLXR_.DBF
datafile 3 switched to datafile copy
input datafile copy RECID=6 STAMP=1013780914 file name=C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_SYSAUX_GLVBVLXJ_.DBF

contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# online the datafiles restored or switched
sql clone “alter database datafile 1 online”;
sql clone “alter database datafile 5 online”;
sql clone “alter database datafile 3 online”;
# recover and open database read only
recover clone database tablespace “SYSTEM”, “UNDOTBS1”, “SYSAUX”;
sql clone ‘alter database open read only’;
}
executing Memory Script

executing command: SET until clause

sql statement: alter database datafile 1 online

sql statement: alter database datafile 5 online

sql statement: alter database datafile 3 online

Starting recover at 16-JUL-19
using channel ORA_AUX_DISK_1

starting media recovery

archived log for thread 1 with sequence 84 is already on disk as file C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_84_GLP3O30R_.ARC
archived log for thread 1 with sequence 85 is already on disk as file C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_85_GLP4HM4Y_.ARC
archived log file name=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_84_GLP3O30R_.ARC thread=1 sequence=84
archived log file name=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_85_GLP4HM4Y_.ARC thread=1 sequence=85
media recovery complete, elapsed time: 00:00:00
Finished recover at 16-JUL-19

sql statement: alter database open read only

contents of Memory Script:
{
sql clone “create spfile from memory”;
shutdown clone immediate;
startup clone nomount;
sql clone “alter system set control_files =
”C:\APP\TBSPIR\AUDITDB\CONTROLFILE\O1_MF_GLVBVD9W_.CTL” comment=
”RMAN set” scope=spfile”;
shutdown clone immediate;
startup clone nomount;
# mount database
sql clone ‘alter database mount clone database’;
}
executing Memory Script

sql statement: create spfile from memory

database closed
database dismounted
Oracle instance shut down

connected to auxiliary database (not started)
Oracle instance started

Total System Global Area 5117050880 bytes

Fixed Size 8757424 bytes
Variable Size 989859664 bytes
Database Buffers 4110417920 bytes
Redo Buffers 8015872 bytes

sql statement: alter system set control_files = ”C:\APP\TBSPIR\AUDITDB\CONTROLFILE\O1_MF_GLVBVD9W_.CTL” comment= ”RMAN set” scope=spfile

Oracle instance shut down

connected to auxiliary database (not started)
Oracle instance started

Total System Global Area 5117050880 bytes

Fixed Size 8757424 bytes
Variable Size 989859664 bytes
Database Buffers 4110417920 bytes
Redo Buffers 8015872 bytes

sql statement: alter database mount clone database

contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# set destinations for recovery set and auxiliary set datafiles
set newname for datafile 7 to new;
# restore the tablespaces in the recovery set and the auxiliary set
restore clone datafile 7;

switch clone datafile all;
}
executing Memory Script

executing command: SET until clause

executing command: SET NEWNAME

Starting restore at 16-JUL-19
allocated channel: ORA_AUX_DISK_1
channel ORA_AUX_DISK_1: SID=5 device type=DISK

channel ORA_AUX_DISK_1: starting datafile backup set restore
channel ORA_AUX_DISK_1: specifying datafile(s) to restore from backup set
channel ORA_AUX_DISK_1: restoring datafile 00007 to C:\APP\TBSPIR\ATCH_PITR_AUDITDB\DATAFILE\O1_MF_USERS_%U_.DBF
channel ORA_AUX_DISK_1: reading from backup piece C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\BACKUPSET\2019_07_14\O1_MF_NNNDF_TAG20190714T141427_GLP3NMT4_.BKP
channel ORA_AUX_DISK_1: piece handle=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\BACKUPSET\2019_07_14\O1_MF_NNNDF_TAG20190714T141427_GLP3NMT4_.BKP tag=TAG20190714T141427
channel ORA_AUX_DISK_1: restored backup piece 1
channel ORA_AUX_DISK_1: restore complete, elapsed time: 00:00:01
Finished restore at 16-JUL-19

datafile 7 switched to datafile copy
input datafile copy RECID=8 STAMP=1013781058 file name=C:\APP\TBSPIR\ATCH_PITR_AUDITDB\DATAFILE\O1_MF_USERS_GLVC0KJR_.DBF

contents of Memory Script:
{
# set requested point in time
set until time “to_date(’14-JUL-2019 14:20:10′,’DD-MON-YYYY HH24:MI:SS’)”;
# online the datafiles restored or switched
sql clone “alter database datafile 7 online”;
# recover and open resetlogs
recover clone database tablespace “USERS”, “SYSTEM”, “UNDOTBS1”, “SYSAUX” delete archivelog;
alter clone database open resetlogs;
}
executing Memory Script

executing command: SET until clause

sql statement: alter database datafile 7 online

Starting recover at 16-JUL-19
using channel ORA_AUX_DISK_1

starting media recovery

archived log for thread 1 with sequence 84 is already on disk as file C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_84_GLP3O30R_.ARC
archived log for thread 1 with sequence 85 is already on disk as file C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_85_GLP4HM4Y_.ARC
archived log file name=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_84_GLP3O30R_.ARC thread=1 sequence=84
archived log file name=C:\APP\ORACLE\FAST_RECOVERY_AREA\AUDITDB\AUDITDB\ARCHIVELOG\2019_07_14\O1_MF_1_85_GLP4HM4Y_.ARC thread=1 sequence=85
media recovery complete, elapsed time: 00:00:00
Finished recover at 16-JUL-19

database opened

contents of Memory Script:
{
# create directory for datapump import
sql “create or replace directory TSPITR_DIROBJ_DPDIR as ”
C:\app\tbspir””;
# create directory for datapump export
sql clone “create or replace directory TSPITR_DIROBJ_DPDIR as ”
C:\app\tbspir””;
}
executing Memory Script

sql statement: create or replace directory TSPITR_DIROBJ_DPDIR as ”C:\app\tbspir”

sql statement: create or replace directory TSPITR_DIROBJ_DPDIR as ”C:\app\tbspir”

Performing export of tables…
EXPDP> Starting “SYS”.”TSPITR_EXP_atch_pkgA”:
EXPDP> Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
EXPDP> Processing object type TABLE_EXPORT/TABLE/STATISTICS/TABLE_STATISTICS
EXPDP> Processing object type TABLE_EXPORT/TABLE/TABLE
EXPDP> . . exported “TBSPIR”.”TEST” 5.148 KB 10 rows
EXPDP> Master table “SYS”.”TSPITR_EXP_atch_pkgA” successfully loaded/unloaded
EXPDP> ******************************************************************************
EXPDP> Dump file set for SYS.TSPITR_EXP_atch_pkgA is:
EXPDP> C:\APP\TBSPIR\TSPITR_ATCH_90840.DMP
EXPDP> Job “SYS”.”TSPITR_EXP_atch_pkgA” successfully completed at Tue Jul 16 13:51:38 2019 elapsed 0 00:00:22
Export completed

contents of Memory Script:
{
# shutdown clone before import
shutdown clone abort
}
executing Memory Script

Oracle instance shut down

Performing import of tables…
IMPDP> Master table “SYS”.”TSPITR_IMP_atch_ygqm” successfully loaded/unloaded
IMPDP> Starting “SYS”.”TSPITR_IMP_atch_ygqm”:
IMPDP> Processing object type TABLE_EXPORT/TABLE/TABLE
IMPDP> Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
IMPDP> . . imported “TBSPIR”.”TEST_PREV” 5.148 KB 10 rows
IMPDP> Processing object type TABLE_EXPORT/TABLE/STATISTICS/TABLE_STATISTICS
IMPDP> Job “SYS”.”TSPITR_IMP_atch_ygqm” successfully completed at Tue Jul 16 13:51:55 2019 elapsed 0 00:00:02
Import completed

Removing automatic instance
Automatic instance removed
auxiliary instance file C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_TEMP_GLVBW55J_.TMP deleted
auxiliary instance file C:\APP\TBSPIR\ATCH_PITR_AUDITDB\ONLINELOG\O1_MF_3_GLVC0OC4_.LOG deleted
auxiliary instance file C:\APP\TBSPIR\ATCH_PITR_AUDITDB\ONLINELOG\O1_MF_2_GLVC0O8G_.LOG deleted
auxiliary instance file C:\APP\TBSPIR\ATCH_PITR_AUDITDB\ONLINELOG\O1_MF_1_GLVC0O6O_.LOG deleted
auxiliary instance file C:\APP\TBSPIR\ATCH_PITR_AUDITDB\DATAFILE\O1_MF_USERS_GLVC0KJR_.DBF deleted
auxiliary instance file C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_SYSAUX_GLVBVLXJ_.DBF deleted
auxiliary instance file C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_UNDOTBS1_GLVBVLXR_.DBF deleted
auxiliary instance file C:\APP\TBSPIR\AUDITDB\DATAFILE\O1_MF_SYSTEM_GLVBVLX5_.DBF deleted
auxiliary instance file C:\APP\TBSPIR\AUDITDB\CONTROLFILE\O1_MF_GLVBVD9W_.CTL deleted
auxiliary instance file tspitr_atch_90840.dmp deleted
Finished recover at 16-JUL-19

RMAN>

 

SQL> select * from tbspir.test_prev;

EMPLOYEE
——————–
xxxx
yyyy
zzzz
wwww
vvvvv
u
ttttt
sssss
rrrr
qqqqq

10 rows selected.

Advertisements
No comments yet

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: