Skip to Content
0
Former Member
Oct 29, 2016 at 09:17 AM

[Microsoft][SQL Server Native Client 11.0]Invalid Descriptor Index / Audit DB no longer updated

1028 Views Last edit Oct 29, 2016 at 09:17 AM 3 rev

Hi All,

Your suggestions / inputs on the issue below would be highly appreciated.

The CMS Logs are filling up with the following Messages

. .\SQLServerStatement.cpp:562: TraceLog message 5 2016/10/22 12:19:17.044|>>|A| | 8388|2536| |||||||||||||||assert failure: (.\SQLServerStatement.cpp:562). (0 : [Microsoft][SQL Server Native Client 11.0]Invalid Descriptor Index)

. .\auditsubsystem_impl.cpp:2677: TraceLog message 6 2016/10/22 12:19:17.310|>>|A| | 8388|2536| |||||||||||||||assert failure: (.\auditsubsystem_impl.cpp:2677). (false : Next event id value should be greater than the current one, check the auditee packing events code).

Environment:

- Clustered Environment of 2 Nodes on Windows Server 2012 R2 x64.

- BOE XI 3.1 SP7 FP 7.2 on both Nodes

- Tomcat 7 on both Nodes

- CMS and Audit Databases on MS SQL Server 2014 SP2 using SQL Server Native Client 11.0 to connect to CMS Database and Audit Database.

The CMS Logs on the 2nd Node does not record such information although it has the same configuration.

We have also noticed that Audit Information is no longer loaded to the Audit Database from 10/18. It's captured in the Auditing Folder but not written to the Database.

Information such as the ones below were also recorded with the Web Intelligence Server Logs (no longer seen since the past few days but Web Intelligence Audit that is no longer written from 10/18. I do see Audit for other actions such as User Logons or Sessions is current / up to date. We only have Web Intelligence Reports.)

AuditeeManager::AuditEventCache::getData: Unknown exception caught. Rewinding all the way back to start of getData so that the auditor won't lose any audit events 2016/10/21 15:48:53.420|>>|A| | 4232|4036| |||||||||||||||assert failure: (.\auditsrc.cpp:1875). (false : AudtieeManager::AuditEventCache::readAuditEvent: Corrupted audit log file. # of tokens in line: 9, Line: 910488 21 53741 -1 0 0 0 0X2=Global+Dashboard&1X3=Network+%2F+Network+Agent+ID&2X6=0&3X45=109636 AbI5_LpMFxFLhxl7DV91KYY). .\auditsrc.cpp:1878: TraceLog message 34 2016/10/21 15:48:53.420|>>|A| | 4232|4036| |||||||||||||||assert failure: (.\auditsrc.cpp:1878). (false : AuditeeManager::AuditEventCache::readAuditEvent: Insufficent number of tokens for a complete audit event. Skipping this event.).

I cannot reproduce the issue on Dev or UAT at this point. Dev and UAT are standalone Environments but as far as OS, Software Version, Repository Databases are concerned, they are identical to that of Production.

Please advise. I have logged with Support but haven't got any pointers on the issue: https://launchpad.support.sap.com/#/incident/pointer/002075129400003762962016

Thank you.

The issue appears to be with the "SQL Generated" Audit Event of the Web Intelligence Processing Servers. I unchecked this Event and it now appears to be injecting the records to the DB.

The Error below is no longer seen in the CMS Logs. (.\SQLServerStatement.cpp:562). (0 : [Microsoft][SQL Server Native Client 11.0]Invalid Descriptor Index).

I continue to see the following in the CMS Logs. assert failure: (.\auditsubsystem_impl.cpp:2677). (false : Next event id value should be greater than the current one, check the auditee packing events code).

Is there any limit for the Audit table/column that accepts the "SQL Generated" Audit Event?