Error: "AUD OS ERROR=1717" along with ORA-28056 in alert log

Products

• Data Loss Prevention Enforce

Issue/Introduction

While reviewing the Oracle Alert log, the following error (or something largely similar) is encountered:

Sun Feb 10 02:50:41 2013 AUD: OS Error = 1717 encountered while writing audit record
opidcl aborting process unknown ospid (7364) as a result of ORA-28056
Sun Feb 10 02:50:41 2013 AUD: OS Error = 1717 encountered while writing audit record
opidcl aborting process unknown ospid (7328) as a result of ORA-28056

AUD: OS Error = 1717 encountered while writing audit record
opidcl aborting process unknown ospid (7328) as a result of ORA-28056

Cause

This error typically indicates the Windows Event Logs are full and unable to add the audit events Oracle is generating.

The solution is typically adding additional space for audit logs, and or clearing the Windows Event logs.

Adjust the properties of the event log to allow overwriting, or allocate more space:

1. Go to the Control Panel
2. Click on Administrative Tools
3. Double-click Event Viewer
4. Expand Windows Logs
5. Right-click Application
6. Click Properties
7. Adjust settings as needed

or

1. Go to the Control Panel
2. Click on Administrative Tools
3. Double-click Event Viewer
4. Expand Windows Logs
5. Right-click each log and Clear log

Environment

Windows Oracle Installation

Resolution

This is an error involving the Windows Event Logging service, and should be corrected but will not impact DLP operation directly.

Microsoft Technet Article discussing how to Configure Windows Event Logs