Hi all,
I have a Oracle 12cR1 databases (12.1.0.2.0) database that is being audited with FGA policies (OS+XML files). I am also using Oracle Audit Vault to manage the audit information on an external software appliance. I am getting this error on the audit vault agent log:
Apr 04,2016 14:10:22 PM logWarn
WARNING: zaodr.c : zaodrSendCleanupTimestamp : OCIStmtExecute failed for OCI set timestamp:4294967295
Apr 04,2016 14:10:22 PM logWarn
WARNING: zaodr.c : zaodrOCIError : OCI Error - ORA-01422: exact fetch returns more than requested number of rows
ORA-06512: at line 1
Looking into MOS it looks like it is related to this: Bug 21962954 : AVDF ERROR: ORA-01422: EXACT FETCH RETURNS MORE THAN REQUESTED NUMBER OF ROWS
According to the bug the problem is that there are more than one record for each audit trail on the dba_audit_mgmt_last_arch_ts view. Here is the current status of mine:
SELECT audit_trail, database_id FROM dba_audit_mgmt_last_arch_ts;
AUDIT_TRAIL DATABASE_ID
------------------------------- -----------------------
XML AUDIT TRAIL 0
OS AUDIT TRAIL 0
XML AUDIT TRAIL 3161861839
OS AUDIT TRAIL 3161861839
When I try to remove those OS and XML records using the DBMS_AUDIT_MGMT package it runs fine but it doesn't delete the records with DBID = 0. I am seeing those records in almost all of my 12c databases but not in the 11g ones, as the database_id column is new on 12c for the dba_audit_mgmt_last_arch_ts view. I have a hypothesis that when these databases were upgraded Oracle created those records on the view and now they cannot be removed. Does anyone know of a way to remove them? are they default timestamps?