Subject: Connect As Sysdba Fails With ORA-28056
  Doc ID: 784068.1 Type:  PROBLEM
  Modified Date:  20-MAR-2009 Status:  MODERATED

Applies to:
Oracle Server - Personal Edition - Version: 11.1.0.6 to 11.1.0.7
This problem can occur on any platform.

Symptoms

connect as sysdba fails with:
ORA-28056: Writing audit records to Windows Event Log failed.

Cause
Event Viewer log is full and not able to log anymore events.

Justified by unpublished Bug.6823281 ORA-28056 WRITING AUDIT RECORDS TO WINDOWS EVENT LOG FAILED

which was closed as not a bug.

Solution
Try doing the following using Event Viewer:
.
To open Event Viewer, click Start, click Control Panel,
click Performance and Maintenance, click Administrative Tools,
and then double-click Event Viewer.
.
You must be logged on as an administrator or a member of the
Administrators group to free an event log.
.
1) When a log is full, it stops recording new events. Clearing the log
is one way to free the log and start recording new events.
.
2) You can also free a log and start recording new events by overwriting
old events. To overwrite events, on the Action menu, click Properties,
and then click Overwrite events as needed. This ensures that all new
events are written to the log, even when the log is full.
.
3) You can also start logging new events by increasing the maximum
log size. To increase the log size, on the Action menu, click Properties,
and then increase the Maximum log size.