Skip to Main Content

Breadcrumb

Question and Answer

Connor McDonald

Thanks for the question, oracle.

Asked: August 30, 2016 - 6:22 am UTC

Last updated: September 15, 2016 - 10:10 pm UTC

Version: 11.2.0

Viewed 10K+ times! This question is

You Asked

Hi team,

Every day we got some alert like -

AUD: Audit Commit Delay exceeded, written a copy to OS Audit Trail

Could you pls let us know what is this and how to resolve this ?

thanks

and Connor said...

Are you on 11.2.0.1 ? If so, there is a bug (8642202 ) that means this can appear too frequently. If you are on a later version, it is cause for investigation. Support note is below:

=====================================
Aud: Audit Commit Delay Exceeded, Written A Copy To Os Audit Trail (Doc ID 788530.1)

In this Document
Symptoms
Changes
Cause
Solution
References
APPLIES TO:

Oracle Database - Enterprise Edition - Version 10.2.0.3 to 11.2.0.1 [Release 10.2 to 11.2]
Information in this document applies to any platform.
Checked for relevance on 12-Jun-2013


SYMPTOMS

You see the following messages appear in your alert.log:

AUD: Audit Commit Delay exceeded, written a copy to OS Audit Trail
CHANGES

You have applied the Audit Cleanup Patch or any superseding patch as referenced from note 731908.1.

CAUSE

This is a change that was introduced within the audit functionality to support Audit Vault, these messages can appear in your alert.log occasionally even if this database is not a source of Audit Vault, the reason is as follows:

The database will guarantee that the transaction writing the audit record will commit within a pre-defined maximum allowed interval which is called the Audit Commit Delay interval. If the transaction takes more than Audit Commit Delay to commit the audit record, the Database will write the same record to the OS audit trail. This is a fallback mechanism to make sure there's always written evidence of an audited action within the defined timeframe, a such it is a feature to enhance audit security. The commit delay is fixed at 5 seconds and cannot be tuned.

SOLUTION

The problem is happening because the audit functionality was not able to commit an audit record within 5 seconds, this means at the time the message was written to the alert.log your database was under stress. The cause of the problem is in most cases not the auditing layer *) and the messages seen in the alert.log are only showing that the auditing is suffering because of the generic performance problems of the environment which might affect other components as well. In rare cases concurrency on the AUD$ table can be the issue, for example during cleanup, in that case consider to schedule audit cleanup at a quieter time or reorganize the AUD$ table etc.

These messages are purely informational and no direct action can or should be taken to avoid them. This is most likely because of a resource problem on your database. If this is seen incidental you can ignore it but if these messages are seen regularly you will likely have a resource problem and also seeing other symptoms of that, you should analyze and solve the generic performance problem first and then these messages will also go away.

Update: the fix to unpublished bug 8642202 changes the behaviour as follows:

Audit Commit Delay increased to 15 seconds and enforced only when AUD$ is initialized for cleanup.

So if you have the fix to Bug 8642202, the delay will be increased to 15 seconds and if you still get these messages and you don't want them and you are not using package DBMS_AUDIT_MGMT for cleanup, you can now disable this security feature by calling:

set serveroutput on
begin
if dbms_audit_mgmt.IS_CLEANUP_INITIALIZED(
audit_trail_type => DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD) then
dbms_audit_mgmt.DEINIT_CLEANUP(
audit_trail_type => DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD);
dbms_output.put_line('DEINIT_CLEANUP for AUDIT_TRAIL_AUD_STD');
end if;
end;
/
=====================================

Rating

  (1 rating)

Is this answer out of date? If it is, please let us know via a Comment

Comments

oracle oracle, September 15, 2016 - 11:16 am UTC

Thanks for reply,

What this procedure will do ?
Will it any impact of the database ?

Thanks
Connor McDonald
September 15, 2016 - 10:10 pm UTC

It disables the feature.

For me - I would simply not worry about the message *directly* but explore to see if you have a resource issue (as the note suggests)

More to Explore

PL/SQL demos

Check out more PL/SQL tutorials on our LiveSQL tool.

PL/SQL docs

PL/SQL reference manual from the Oracle documentation library