Unified Audit blocking SYS access

I got reported (by a DBA) that access to a database (as / sysdba) was hanging.

First place I looked was the alert.log of the database – bingo, the following message was there:

ORA-1692: unable to extend lobsegment AUDSYS.SYS_LOB0000077797C00014$$ partition SYS_LOB_P2579 by 1024 in tablespace AUDITTS

2018-04-09 11:35:07.110000 -04:00

When I saw AUDSYS.XXXX the first thing that came to my mind was Unified Audit. You see, the purpose of auditing is to track changes that users make in the database and that includes super user and audit events include connecting to the database.

Since SYS was trying to connect an audit record needed to be created, but as the tablespace dedicated to auditing was full it would cause the database to hung. That didn’t happen before Unified Auditing was introduced – now even SYS user’s actions generate audit records.

Benefits of Unified Audit are huge but won’t bore you with the details as there’s plenty of great blog posts and documentation available at hand and simple google search for it will land you there.

The solution. Since I wasn’t able to connect “/ as sysdba” there was no way for me to increase the size of the AUDITTS tablespace which was the real solution. Amen for “prelim” – connecting with SqlPlus with the prelim option allows you not only to gather info of a hung instance, but also to bypass the Unified Audit  filter.

So, I connected using the prelim option and shutdown the instance

sqlplus -prelim / as sysdba
SQL> shutdown abort
SQL>  exit

Now, I still needed to increase the size of the tablespace. If I had started the database normally I would be again in the same place, hanging due to the SYS connection attempt pending to be written to the audit trail. Amen for “upgrade” mode. Starting the database in “upgrade” mode allows you not only to run upgrade procedures, but also you can take advantage that it permits certain operations (and of course bypass the Unified Audit filter).

So I started the database using the “upgrade” mode and resized my tablespace

sqlplus / as sysdba
SQL> startup migrate
SQL> select tablespace_name, file_name, bytes/1024/1024, maxbytes/1024/1024, autoextensible from dba_Data_files
where tablespace_name in ('AUDITTS') order by tablespace_name, file_name;

TABLESPACE_NAME   FILE_NAME                                  BYTES/1024/1024 MAXBYTES/1024/1024 AUT
----------------- ------------------------------------------ --------------- ------------------ ---
AUDITTS           +DATA/DBFAZ/DATAFILE/auditts.336.960128707 10240           0                  NO

SQL> alter database datafile '+DATAC4/DIS1/DATAFILE/auditts.336.960128707' resize 20G;

The rest is history, actions followed were just to shutdown and startup the database normally and provide the solution to the DBA (and of course write this lovely post)

SQL> shutdown immediate
SQL> startup

Now for some lessons learned

  • Keep an eye on your space usage, all this hung/downtime could have been prevented if space were added or if audit records were purged on time
  • Be smart and surgeon-minded when configuring/enabling auditing, specially with Unified Audit, as you don’t want to audit it all, but also don’t want to miss actions worth auditing. Take the time to plan for what you want to audit and also plan for what you no longer need (meaning have a purge plan in mind as well)

That’s it for this post – thanks for reading

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s