Oracle Audit: Why Logons are less than 0.1% of logoffs?
It may depend on whether you are using connection pooling or not.

Also, do you realize LOGON and LOGOFF for a session are recorded in the same audit row? So here the LOGON is showing how many are still logged in right now.

Consider the following scenario. 

SQL&gt; select ACTION_NAME, username, count(*) from dba_audit_session group by action_name, username;


When you run this first time it shows LOGON 1.

Without logging off, try to connect as the same user as you have connected before.

SQL&gt; select ACTION_NAME, username, count(*) from dba_audit_session group by action_name, username;


Now, it shows LOGON 1 and LOGOFF 1.

SQL&gt; select ACTION_NAME, username, count(*) from dba_audit_session group by action_name, username;


Now, it shows LOGON 1 and LOGOFF 2.

Each time you are seeing the 1 currently logged in session as 'LOGON', and the (increasing) number of completed sessions as 'LOGOFF'.