Oracle SYS Auditing with Audit Trail to DB
This is expected behaviour SYS auditing will always go to the filesystem.

The documentation for AUDIT_FILE_DEST states:


  Oracle Database also writes mandatory auditing information to this
  location, and if the AUDIT_SYS_OPERATIONS initialization parameter is
  *set, writes audit records for user SYS*.


... and the documentation for AUDIT_SYS_OPERATIONS states:


  Enables or disables the auditing of top-level operations directly
  issued by user SYS, and users connecting with SYSDBA or SYSOPER
  privilege. Oracle Database writes the audit records to the audit trail
  of the operating system. If you set the AUDIT_TRAIL initialization
  parameter to XML or XML, EXTENDED, it writes the audit records in XML
  format. On UNIX systems, if you have also set the AUDIT_SYSLOG_LEVEL
  parameter, then it overrides the AUDIT_TRAIL parameter, which writes
  the SYS audit records to the system audit log using the SYSLOG
  utility.


Documentation link here.