Audit all does not capture truncate
2 (+1) possible reasons:

0 - AUDIT ALL does not audit TRUNCATE operations. Use AUDIT TABLE BY ACCESS;

1 - You perform the above as SYS user. Actions performed by SYS are
    audited into files, under the location of audit_file_dest

2 - AUDIT (Traditional Auditing) 


  Track the issuance of SQL statements in subsequent user sessions. You
  can track the issuance of a specific SQL statement or of all SQL
  statements authorized by a particular system privilege. Auditing
  operations on SQL statements apply only to subsequent sessions, not to
  current sessions.


Try it in a new session.