DV_OWNER disables database vault. how to audit it

Hi All,

IF  DV_OWNER  user   disable  vault  (EXEC DVSYS.DBMS_MACADM.DISABLE_DV)    ,   I  can see  this action in DVSYS.AUDIT_TRAIL$   .  But  DV_OWNER user has privilage  dv_audit_cleanup role  and  can delete this action from  DVSYS.AUDIT_TRAIL$.

if  i  audit   dv_owner  user with database audit (audit all by dv_owner) i thought  i can catch dv_owner  if he run disable vault command. Unfortunately   this action does not inserted to  sys.aud$

Enabling vault  command  inserted to aud$ like below,  but disabling  not  .     Do you have any idea ?  and how to catch dv_owner ?