解决过程：
打开windows 事件查看器，将应用程序日志清理一下，重新连接数据库，连接成功。启动数据库，启动正常。
Symptoms
connect as sysdba fails with:
ORA-28056: Writing audit records to Windows Event Log failed.
Cause
Event Viewer log is full and not able to log anymore events.
Justified by unpublished Bug.6823281 ORA-28056 WRITING AUDIT RECORDS TO WINDOWS EVENT LOG FAILED
which was closed as not a bug.
Solution
Try doing the following using Event Viewer:
.
To open Event Viewer, click Start, click Control Panel,
click Performance and Maintenance, click Administrative Tools,
and then double-click Event Viewer.
.
You must be logged on as an administrator or a member of the
Administrators group to free an event log.
.
1) When a log is full, it stops recording new events. Clearing the log
is one way to free the log and start recording new events.
.
2) You can also free a log and start recording new events by overwriting
old events. To overwrite events, on the Action menu, click Properties,
and then click Overwrite events as needed. This ensures that all new
events are written to the log, even when the log is full.
.
3) You can also start logging new events by increasing the maximum
log size. To increase the log size, on the Action menu, click Properties,
and then increase the Maximum log size.
还有个问题，域用户，虽然是属于admin组，但却无法查看日志？？
最后通过
コントロール パネル パフォーマンスとメンテナンス 管理ツール イベント ビューア