How Does Oracle audit sys users (OracleonWindows)

Audit problem: when the sys user is audited, the audit file that records sys user operations cannot be found in audit_file_dest. I have installed oracle10g (10.

Audit problem: when the sys user is audited, the audit file that records sys user operations cannot be found in audit_file_dest. I have installed oracle 10g (10.

Audit problem: when the sys user is audited, the audit file that records sys user operations cannot be found in audit_file_dest.

I installed an Oracle 10g (10.2.0.3.0) on Windows 7. I did the same thing and found that the audit records of common users can be found in dba_audit_trail, the audit Directory D: \ ORACLE \ PRODUCT \ 10.2.0 \ ADMIN \ ORCL \ ADUMP that records sys user audit information is always empty. Why?

The answer is from metalink. For windows systems, audit information for sys users does not exist in the directory specified by the AUDIT_FILE_DEST parameter, but in windows event manager.

(Navigation Path: Computer Management-> Event View-> Windows Logs-> Application)

The audit parameter settings on the local machine (for windows, audit sys users only need to set audit_sys_operations to true; for unix users, audit_file_dest is also required ):

SQL> show parameter audit

NAME TYPE VALUE
---------------------------------------------------------------------------------------------------
Audit_file_dest string D: \ ORACLE \ PRODUCT \ 10.2.0 \ ADMIN \ ORCL \ ADUMP
Audit_sys_operations boolean TRUE
Audit_trail string DB
SQL>

Metalink explanation:

Exception: As 'audit _ FILE_DEST 'is invalid on Windows, all Oracle AUDIT trail information on Windows is recorded in the Windows event viewer.

Audit SYS User Operations [ID 174340.1]