Steps to audit sys operations in Oracle
SQL> ALTER SYSTEM SET audit_sys_operations=true SCOPE=spfile; SQL> ALTER SYSTEM SET audit_trail=OS SCOPE=spfile; SQL> SHUTDOWN IMMEDIATE SQL> STARTUP
Where is the log files located
The sys audit log will be available in the operating system path specified by AUDIT_FILE_DEST
AUDIT_SYS_OPERATIONS enables or disables the auditing of operations issued by user SYS, and users connecting with SYSDBA or SYSOPER privileges. The audit records are written to the operating system’s audit trail. The audit records will be written in XML format if the AUDIT_TRAIL initialization parameter is set to XML.