Fixed: ORA-28056: Writing audit records to Windows Event Log failed

Ora-28056 event log failed

Today I tried to connect with Oracle Database 11g and got ORA-28056 error. Oracle Database was installed on Windows Server 2003.

I just issued the following command and got this error.


C:\>sqlplus /nolog

SQL*Plus: Release Production on Fri Jan 23 13:40:09 2014

Copyright (c) 1982, 2010, Oracle.  All rights reserved.

SQL> conn / as sysdba

ORA-28056: Writing audit records to Windows Event Log failed

OSD-197314968: Message 197314968 not found;  product=RDBMS; facility=SOSD

O/S-Error: (OS 1502) The event log file is full.

ORA-01075: you are currently logged on

Cause of Problem:

The problem was occurred because Event Viewer log was full and not been able to log anymore events.

Solution of the Problem:

You need to free the event viewer log.

How to free event viewer log?


First login to your Server machine as an Administrator.


Now Click on START > Control Panel > Performance and Maintenance > Administrative Tools and Click on Event Viewer.


As the Event Log is full and unable to record new events, clear the logs by just right clicking on the Application/System/Security on the left side and select Clear All Events. It will ask you to save the events, if you want to save then click on Yes otherwise choose No option.


You Must Read:

How to fix – ORA-01033: ORACLE initialization or shutdown in progress.


You can also select overwrite option under properties of Application/System/Security, if required. It will automatically overwrite all old events to new events. You don’t need to clear the logs again and again.

There is one more option by which you can increase the size of logs as shown in below snapshot.


This tutorial will resolve your problem. Share this to your friends to enhance their knowledge too.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top
Scroll to Top