IF USING LINUX OR UNIX, IDENTIFY THE LOCATION OF THE SYSTEM AUDIT TRAIL BY QUERYING THE PARAMETER AUDIT_FILE_DEST

5. If using Linux or Unix, identify the location of the system audit trail by

querying the parameter AUDIT_FILE_DEST. This will be used for the auditing

of SYS operations, irrespective of the setting for AUDIT_DEST. With SQL*Plus:

select value from v$parameter where name='audit_file_dest';

Using an operating system utility, navigate to this directory and open the most

recently created file.

If using Microsoft Windows, open the Application Log in the Event Viewer.

Either way, you will see the SELECT statement that you executed as SYS, with

details of the operating system user and hostname.