On the first day after the Spring Festival in 2018, I encountered a problem that the audit log could not be written in. The specific solution is as follows
I. error log
Database error log content:
Fri Feb 23 11:16:30 2018
OS Audit file could not be created; failing after 6 retries
Fri Feb 23 11:16:36 2018
OS Audit file could not be created; failing after 6 retries
Fri Feb 23 11:16:43 2018
OS Audit file could not be created; failing after 6 retries
Fri Feb 23 11:16:57 2018
OS Audit file could not be created; failing after 6 retries
Fri Feb 23 11:17:25 2018
OS Audit file could not be created; failing after 6 retries
OS Audit file could not be created; failing after 6 retries
Fri Feb 23 11:17:33 2018
OS Audit file could not be created; failing after 6 retries
Fri Feb 23 11:17:35 2018
OS Audit file could not be created; failing after 6 retries
Program error log content:
ORA-09925: Unable to create audit trail file
Linux-x86_ 64 Error: 28: No space left on device
Second, the causes of the problem
The common reasons are as follows:
1. The audit log cannot be written due to full disk space
2. Unable to write disk space due to insufficient disk directory permissions
3. Database table space full, unable to write data file
4. Too many disk audit directory files result in write failure
5. The disk is damaged, there are bad tracks, etc
3. Solutions
1. First check whether the disk space is full
2. View database audit types
3. View the directory space of audit log
4. View the number of audit log directory files
5. Check the disk for damage
6. In order to resume business as soon as possible, we should clean up adump audit directory urgently
Because of the large amount of log content, when it is not possible to clean the log by time (usually through LS *. Aud | xargs – N 10 RM – RF), you can clean it by cleaning the directory
7. Check the content and frequency of audit log to find out specific problems
After investigation, it is found that 18 audit logs are generated every minute, and the connection process numbers are different (it means short connection, continuous disconnection and reconnection). Then according to the log content, find the specific connection user and program IP, and contact the relevant programs for communication and processing
