User SYS logged on from. Where I can find source of access?
Where I can find the logs of this audit user?
  


By default, audit logs for SYSDBA or SYSOPER privileges are stored on AUDIT_FILE_DEST directory.

SQL&gt; show parameter AUDIT_FILE_DEST

NAME                     TYPE         VALUE
------------------------ ----------- ------------------------------
audit_file_dest          string       /u01/app/oracle/admin/orcl/adump


For non-sys users, audit logs are stored in data dictionary table called `AUD$' and have several views to get these information.

SELECT view_name
FROM   dba_views
WHERE  view_name LIKE 'DBA%AUDIT%'
ORDER BY view_name;



  
  "User SYS logged on from kali". What would this kali be?
  


Kali is the host name/domain name from which the user way logged on to the database server.