This content has been marked as final. Show 4 replies
The audit records for sys do not have the EVENT set. This is a fact and cannot be changed as of now. If you need to see what SYS did, you have to look at the SQL Text. If for example you want to be alerted when SYS performed a CREATE USER or a DROP USER you will have to update your alert to see if that command is in the SQLText.
Indeed, as you indicate the audit_sys_operations parameter needs to be set in order for the audit events to be generated.
In this case the events are generated by the database and received by the audit vault server, however the alerts are not generated by the audit vault server. Hence the suggestion in the 2nd post on how to generate an alert is a specific situation occurs.