B Oracle Audit Vault Error Messages

The following sections describe the Oracle Audit Vault error messages:

Audit Vault Server Error Messages
Oracle Audit Vault Client Error Messages

B.1 Audit Vault Server Error Messages

This section describes the following Audit Vault Server-side error message codes:

Generic Error Codes
Source Database and Event Error Codes
Collector Error Codes
Attribute Definition Error Codes
Alert Error Codes
Server-Side Audit Service Error Messages
Data Warehouse Error Messages
Other Audit Vault Policy Error Messages

B.1.1 Generic Error Codes

This section describes the generic error codes.

46501, invalid %s: Cause: Invalid value specified.; Action: Provide a valid non-NULL value with a valid length.

46502, NULL in %s: Cause: NULL value specified.; Action: Provide a non-NULL value.

46503, object %s already exists: Cause: Object specified was already present in the system.; Action: Provide a different value. Remember that even if you drop an object from Oracle Audit Vault, such as a source database, the name of the dropped object is stored internally.

46504, duplicate %s: Cause: Value was repeated in the input.; Action: Remove the duplicates.

46505, object %s does not exist: Cause: Object specified was not present in the system.; Action: Provide a different value.

46612, invalid number of years %s for audit data retention; must be positive: Cause: Invalid number of years was specified for audit data retention.; Action: Specify a valid number, and ensure that this number is positive.

46626, Invalid number of years %s for audit data retention; must be positive: Cause: Invalid number of years was specified for audit data retention; Action: Specify valid number, the number should be positive.

46966, Function AV_TRUNCATE_CLOB does not exist in source database: Cause: The latest version of script zarsspriv.sql was not run. This can happen if you had configured the source database using a release earlier than the latest release of Oracle Audit Vault. The agent from the earlier Oracle Audit Vault release could contain a zarsspriv.sql script that is not compatible with the latest installed release of Oracle Audit Vault. You can find the zarsspriv.sql script in the $ORACLE_HOME/av/scripts/streams/source directory in the Oracle Audit Vault collection agent home directory.; Action: None. Function created automatically.

B.1.2 Source Database and Event Error Codes

This section describes the source database and event error codes.

46521, NULL value passed for a mandatory attribute: Cause: A mandatory attribute was set to a NULL value.; Action: Provide a non-NULL value for the mandatory attribute.

46522, mandatory attribute %s missing in the input: Cause: Mandatory attribute name was missing in the attribute value list.; Action: Provide the value for mandatory attribute.

46523, attempting to drop Event Category with active Events: Cause: Event category specified had active Events.; Action: Drop the active events before dropping this event category.

46524, active Collectors exist for the Source: Cause: Source database specified had collectors which were active.; Action: Drop active collectors for the given source database.

46525, Sourcetype-specific extension for Category already exists: Cause: Event category was specified which already has a format extension for the given source database type.; Action: Provide an event category that does not have a source database type-specific extension.

46526, attempting to drop an in-use Event mapping: Cause: Event mapping specified was in use.; Action: Provide an event mapping that is not being used.

46527, attempting to change an immutable attribute: Cause: An immutable attribute was specified.; Action: Provide a mutable attribute.

46528, attempting to drop system-defined Event: Cause: Event specified was system-defined.; Action: Provide a user-defined event.

46529, attempting to drop Event with active mappings: Cause: Event specified had active event mappings.; Action: Drop the active mappings before dropping this event.

46530, attempting to drop Sourcetype with active Sources: Cause: Source type specified had active source databases.; Action: Drop the active source databases before dropping this source type.

46531, unsupported Source version: Cause: Version specified for the source database was not supported.; Action: Provide a source database version that is equal to or greater than the minimum supported version for the corresponding source database type. See Section 1.3.1 for a listing of supported database versions.

B.1.3 Collector Error Codes

This section describes the collector error codes.

46506, attribute %s exists in %s: Cause: Attribute specified was already present.; Action: Provide a different attribute.

46507, invalid data or type name for attribute %s: Cause: Data type of the value specified was different from the type name of the attribute.; Action: Change the type name or the type of the value for the attribute.

46541, attempting to drop Collector Type with active Collectors: Cause: One or more collectors for this collector type were active.; Action: Drop all active collectors for this collector type.

46542, attempting to drop an Agent with active Collectors: Cause: One or more collectors for this agent were active.; Action: Drop all active collectors for this agent.

46543, attempting to drop a Collector before disabling the collection: Cause: The collection for the collector specified was not disabled.; Action: Disable the collection before dropping the collector.

46544, attempting to drop an Agent before disabling it: Cause: The agent specified was not disabled.; Action: Disable the agent before dropping it.

46964, Connector was not able to reconnect to Source Database: Cause: Maximum number of attempts to reconnect was exceeded.; Action: Verify connectivity and that the database is started. You can use the lsnrctl status command to check the status of the database.

B.1.4 Attribute Definition Error Codes

This section describes the attribute definition error codes.

46508, too many attributes of type %s specified: Cause: Specified number of attributes of this type exceeded the maximum number supported.; Action: Specify a fewer number of attributes of this type.

46551, attempting to change the type of an attribute currently in use: Cause: Attribute specified was in use.; Action: Provide an attribute that is not being used.

46552, attempting to drop an attribute currently in use: Cause: Attribute specified was in use.; Action: Provide an attribute that is not being used.

46553, attempting to change the type of an attribute without providing a new default value: Cause: Current type of the default value did not match with the new type specified.; Action: Provide a new default value for the attribute.

46965, Attribute %s is longer than 4000 bytes and was clipped: Cause: When the attribute was converted to UTF8 encoding, it became longer than 4000 bytes.; Action: None. It was clipped automatically after conversion.

B.1.5 Alert Error Codes

This section describes the alert error codes.

46561, no Format defined for the Source Type and Category: Cause: Format for the specified source type and category pair was not present in the system.; Action: Provide source type and category pair which already has a format defined.

46562, error in Alert condition: Cause: Invalid alert condition was specified.; Action: Correct the alert condition.

46563, attempting to drop a nonuser-defined Alert: Cause: Nonuser-defined alert was specified.; Action: Provide a user-defined alert.

46599, Internal error %s: Cause: Internal error occurred in Oracle Audit Vault.; Action: Contact Oracle Support Services.

B.1.6 Server-Side Audit Service Error Messages

This section describes the server-side audit service error codes.

46601, The authenticated user is not authorized with audit source: Cause: User is not authorized to send audit data on behalf of this audit source.; Action: Connect as the user who is associated with the source. Or grant this user appropriate authorization by changing the properties of the source database.

46602, Error on audit record insert as RADS partition full: Cause: RADS partition table is full.; Action: Purge the RADS partition table through archive.

46603, Error on audit record insert as RADS_INVALID table full: Cause: RADS_INVALID table is full.; Action: Need to purge RADS_INVALID table or make its size larger.

46604, Error on insert as Error table full: Cause: Error table is full.; Action: Need to purge the error table.

46605, There are more recovery entries than the maximum member can be returned: Cause: There are more recovery entries for this collector.; Action: Need to purge the old entries from the recovery table.

46606, There is no recovery entry for the given name: Cause: There was no recovery context matching to the given name.; Action: Need to check if the name was correct or if the recovery context was saved for this name.

46607, There are more configuration entries than the maximum member can be returned: Cause: There were more configuration entries for this collector.; Action: Need to reduce the configuration entries for this collector.

B.1.7 Data Warehouse Error Messages

This section describes messages from the data warehouse.

46620, invalid interval %s for data warehouse duration; must be positive: Cause: Invalid interval was specified for data warehouse duration.; Action: Specify valid interval, the interval should be positive.

46621, invalid start date %s for data warehouse operation; must be less than %s: Cause: Invalid start date was specified for data warehouse load/purge operation.; Action: Specify valid start date, the start date must be less than current date - warehouse duration.

46622, invalid number of days %s for data warehouse operation; must be greater than 0: Cause: Invalid number of days was specified for data warehouse load/purge operation.; Action: Specify valid number of days, the number of days must be positive

46623, cannot execute warehouse operation; another operation is currently running: Cause: A warehouse operation was executed while another operation is currently running.; Action: Wait for the operation to complete before reissuing the command.

46624, invalid schedule %s for data warehouse refresh schedule: Cause: Invalid schedule was specified for data warehouse refresh.; Action: Specify valid non-null schedule.

46625, invalid repeat interval %s for data warehouse refresh schedule: Cause: Invalid schedule was specified for data warehouse refresh.; Action: Specify valid non-null repeat interval.

B.1.8 Other Audit Vault Policy Error Messages

This section describes Oracle Audit Vault policy error messages.

46640, specified source name %s was not found: Cause: Invalid source name was specified.; Action: Specify a valid source name.

46641, archive does not exist: Cause: Invalid archive id was specified.; Action: Specify valid archive ID.

46642, database audit type invalid: Cause: Invalid database audit type specified.; Action: Database audit type must be S for standard or F for FGA.

46643, audit frequency invalid: Cause: Invalid audit frequency specified.; Action: Audit frequency must be A for "by access" or S for "by session".

46644, return type invalid: Cause: Return type was invalid.; Action: Return type must be S for "success", F for "failure", or B for "both".

46645, privilege flag invalid: Cause: Privilege flag is invalid.; Action: The privilege flag must be Y or N.

46646, specified Agent name %s was not found: Cause: Invalid Agent name was specified.; Action: Specify a valid Agent name.

B.2 Oracle Audit Vault Client Error Messages

This section describes the following Oracle Audit Vault client error messages:

General Error Messages
CSDK Error Messages
OSAUD Collector Error Messages
DBAUD Collector Error Messages

B.2.1 General Error Messages

This section describes the general error messages.

46800, Normal, successful completion: Cause: Normal exit.; Action: None.

46801, Out of memory: Cause: The process ran out of memory.; Action: Increase the amount of memory on the system.

B.2.2 CSDK Error Messages

This section describes the CSDK error messages.

46821, generic CSDK error (line %d): Cause: There was a generic error in CSDK.; Action: Contact Oracle Support Services.

46822, no collector details for collector %s: Cause: Collector is not properly set up in AV tables.; Action: Configure collector.

46823, attribute %s is not valid for category: Cause: Collector attempted to set invalid attribute.; Action: Contact collector owner.

46824, type is not valid for attribute %s: Cause: Collector attempted to set value of wrong type to attribute.; Action: Contact collector owner.

46825, invalid record: Cause: Collector attempted to pass invalid record.; Action: Contact collector owner.

46826, invalid parameter %s (line %d): Cause: Collector attempted to pass invalid parameter.; Action: Contact collector owner.

46827, invalid context: Cause: Collector attempted to pass invalid context.; Action: Contact collector owner.

46828, OCI layer error %d: Cause: OCI layer returned error.; Action: Contact collector owner.

46829, category %s unknown: Cause: Collector attempted to pass category not configured in AV.; Action: Contact collector owner.

46830, null pointer (line %d): Cause: Collector attempted to pass null pointer.; Action: Contact collector owner.

46831, invalid source event id (%s): Cause: Collector passed source event id not suitable for category.; Action: Contact collector owner.

46832, internal error (line %d): Cause: Internal error occurred in CSDK.; Action: Contact Oracle Support Services.

46833, invalid error record: Cause: Collector attempted to pass invalid error record.; Action: Contact collector owner.

46834, missing attribute in error record: Cause: One or more attributes of error record is missing.; Action: Contact collector owner.

46835, duplicate error attribute: Cause: Collector attempted to set already set attribute.; Action: Contact collector owner.

46836, error record in use: Cause: Attempt to create a new error record before sending or dropping the previous one.; Action: Contact collector owner.

46837, missing eventid attribute in audit record: Cause: Event ID attributes of audit record are missing.; Action: Contact collector owner.

46838, Internal Error: Failed to insert %s into %s hash table: Cause: Core hash table insertion function failed.; Action: Contact collector owner.

B.2.3 OSAUD Collector Error Messages

This section describes the OSAUD collector error messages.

46901, internal error, %s: Cause: There was a generic internal exception for OS Audit Collector.; Action: Contact Oracle Support Services.

46902, process could not be started, incorrect arguments: Cause: Wrong number of arguments or invalid syntax used.; Action: Please verify that all the required arguments are provided. The required arguments are Host name, Source name, Collector name, and the Command.

46903, process could not be started, operating system error: Cause: The process could not be spawned because of an operating system error.; Action: Please consult the log file for detailed operating system error.

46904, collector %s already running for source %s: Cause: Collector specified was already running.; Action: Provide a different collector or source name.

46905, collector %s for source %s does not exist: Cause: Collector specified was not running.; Action: Provide a different collector or source name.

46906, could not start collector %s for source %s, reached maximum limit: Cause: No more collectors could be started for the given source.; Action: None.

46907, could not start collector %s for source %s, configuration error: Cause: Some collector parameters were not configured correctly.; Action: Check the configuration parameters added during ADD_COLLECTOR.

46908, could not start collector %s for source %s, directory access error for %s: Cause: Access to specified directory was denied.; Action: Verify the path is correct and the collector has read permissions on the specified directory.

46909, could not start collector %s for source %s, internal error: [%s], [%d]: Cause: An internal error occurred while starting the collector.; Action: Contact Oracle Support Services.

46910, error processing collector %s for source %s, directory access error for %s: Cause: Access to specified directory was denied.; Action: Verify the path is correct and the collector has read permissions on the specified directory.

46911, error processing collector %s for source %s, internal error: [%s], [%d]: Cause: An internal error occurred while processing the collector.; Action: Contact Oracle Support Services.

46912, could not stop collector %s for source %s: Cause: An error occurred while closing the collector.; Action: None.

46913, error in recovery of collector %s for source %s: %s: Cause: An error occurred while accessing the file.; Action: Verify the path is correct and the collector has read permissions on the specified directory.

46914, error in recovery of collector %s for source %s, internal error: [%s], [%d]: Cause: An internal error occurred while getting recovery information for collector.; Action: Contact Oracle Support Services.

46915, error in parsing of collector %s for source %s: %s: Cause: An error occurred while accessing the file.; Action: Verify the path is correct and the collector has read permissions on the specified directory.

46916, error in parsing of collector %s for source %s, internal error [%s], [%d]: Cause: An internal error occurred while parsing data for collector.; Action: Contact Oracle Support Services.

46917, error processing request, collector not running: Cause: OS Audit Collector was not running and a command was issued.; Action: Start the collector using command START.

46918, could not process the command; invalid command: Cause: An invalid value was passed to the command argument.; Action: Please verify that a valid value is passed to command argument. The valid values are START, STOP and METRIC.

46919, error processing METRIC command; command is not in the required format: Cause: METRIC command was not in the required METRIC:XYZ format.; Action: Please verify that the metric passed is in METRIC:XYZ format where XYZ is the type of metric (Example: METRIC:ISALIVE).

46920, could not start collector %s for source %s, directory or file name %s is too long: Cause: The name of directory or file was too long.; Action: Verify the length of the path is less than the system-allowed limit.

46921, error processing collector %s for source %s, directory or file name %s is too long: Cause: The name of directory or file was too long.; Action: Verify the length of the path is less than the system-allowed limit.

46922, could not start collector %s for source %s, cannot open Windows event log: Cause: Windows event log could not be opened.; Action: Verify event log exists.

46923, OCI error encountered for source database %s access, audit trail cleanup support disabled.: Cause: An error was encountered while attempting to connect to or execute SQL statements on the source database.; Action: Verify source database and listener are up and connect information is correct.

46924, Corrupted recovery information detected for collector %s for source %s: Cause: Corrupted recovery information detected.; Action: Contact Oracle Support Services.

46925, error in parsing XML file %s for collector %s and source database %s : error code %u.: Cause: An internal error occurred while parsing data for collector.; Action: Verify that collector has read permissions on the file and the file is in proper XML format. Contact Oracle Support Services for patch set.

46926, error in recovery of XML file %s for collector %s and source database %s : error code %u.: Cause: An internal error has occurred while parsing data for collector.; Action: Verify that collector has read permissions on the file and the file is in proper XML format. Contact Oracle Support Services for patch set.

46927, Syslog is not configured or error in getting audit files path for syslog for collector %s and source database %s.

Cause: One of the following occurred:

facility.priority was not valid.
There was no corresponding path for facility.priority setting.
Source database was only returning facility and there was no corresponding path for facility.* setting.

Action: Configure syslog auditing to a valid facility.priority setting and corresponding valid path. If source database only returning the facility, then contact Oracle Support Services for patch set.

46928, Collector %s for source %s cannot read complete file %s: Cause: File size is more than 2GB.; Action: File size should be less than 2GB. Please use log rotation to limit the file size to less then 2GB.

B.2.4 DBAUD Collector Error Messages

This section describes the DBAUD collector error messages.

46941, internal error, on line %d in file ZAAC.C, additional information %d: Cause: There was a generic internal exception for AUD$ Audit Collector.; Action: Contact Oracle Support Services.

46942, invalid AUD Collector context: Cause: The AUD Collector context passed to collector was invalid.; Action: Make sure that context passed is the context returned by ZAAC_START.

46943, NULL AUD Collector context: Cause: The pointer to AUD Collector context passed to Collector was NULL.; Action: Make sure that context passed is the context returned by ZAAC_START.

46944, conversion error in column %s for <%s>: Cause: The VARCHAR retrieved from AUD$ or FGA_LOG$ table could not be converted to ub4.; Action: Correct value in source database.

46945, bad recovery record: Cause: The recovery record retrieved from Audit Vault was damaged.; Action: None. The record will be corrected automatically.

46946, too many active sessions: Cause: The number of active sessions exceeded the specified number in the GV$PARAMETER table.; Action: Contact Oracle Support Services.

46947, CSDK layer error: Cause: CSDK layer returned error indication.; Action: Action should be specified in CSDK error report.

46948, already stopped: Cause: AUD collector already stopped because of previous fatal error.; Action: Restart Collector.

46949, log level: Cause: Specified log level was invalid.; Action: Use a legal log level (1,2,3).

46950, log file: Cause: An error occurred during the opening of the log file.; Action: Make sure that the log directory exists, and that the directory and log file are writable.

46951, bad value for AUD collector attribute: Cause: Specified collector attribute was invalid.; Action: Correct the attribute value in the Audit Vault table AV$ATTRVALUE.

46952, bad name for AUD collector metric: Cause: The specified metric name was undefined.; Action: Use a correct metric name.

46953, unsupported version: Cause: The specified version of the source database is not supported.; Action: Update to supported version.

46954, recovery context of 10.x: Cause: Source database (9.x) was incompatible with 10.x recovery context.; Action: Clean up AUD$ and FGA_LOG$ tables and recovery context.

46955, recovery context of 9.x: Cause: Source database (10.x) was incompatible with 9.x recovery context.; Action: Clean up AUD$ and FGA_LOG$ tables and recovery context.

46956, FGA_LOG$ table of 9.x: Cause: Source database (10.x) was incompatible with 9.x rows of FGA_LOG$.; Action: Clean up FGA_LOG$ table.

46957, RAC recovery context: Cause: Non-RAC source database was incompatible with RAC recovery context.; Action: Clean up AUD$ and FGA_LOG$ tables and recovery context.

46958, Non-RAC recovery context: Cause: RAC source database was incompatible with non-RAC recovery context; Action: Clean up AUD$ and FGA_LOG$ tables and recovery context.

46959, bad authentication information: Cause: Incorrect format of authentication information in the column COMMENT$TEXT.; Action: Contact Oracle Support Services.

46960, bad metric request: Cause: Unknown metric name (%s) was provided in metric request.; Action: Contact Oracle Support Services.

46961, internal error, on line %d in file ZAAC.C, additional info |%s|: Cause: There was a generic internal exception for AUD$ Audit Collector.; Action: Contact Oracle Support Services.

46962, Database Vault audit table is not accessible: Cause: Database Vault was not set up properly or proper role was not granted to user used by collector.; Action: Set up Database Vault and make sure that DVSYS.AUDIT_TRAIL$ is accessible to the user used by collector.

46963, Some rows may have been missed by Audit Vault or may be duplicated: Cause: Collector encountered rows in the SYS.AUD$ or FGA_LOG$ tables with SESSIONID <= 0.; Action: Contact Oracle Support Services.