os_username vs username in Oracle audits I have recently been given the task of building reports from the audits of our Oracle 11g database. While not being the DBA and him being on vacation for a few weeks I have troubles understanding how some informations are recorded. 

My main concern is about the os_username and username field. When reading Oracle documentation I see that:


  os_username: Operating system login username of the user whose actions were audited
  
  username: Name (not ID number) of the user whose actions were audited.


In the audit_trail I found that os_username contained mostly login username which sure sounds like the definition but also contained entries by "oracle". While the obviously correct os_username had username of what seems to be our systems or things like OEM, the records with a os_username "oracle" all had username entries of login username making this confusing. 

In the end, what is the real difference between those 2 columns and on which should I base my query to know how many times a user was recorded?

Any other references I could read on the subject would also be appreciated
The os_username is the name of the user that runs the application. The username is the name of the user defined in the database.

Suppose that UserA is logged on his desktop as UserA and runs an application to modify the data. When he is asked to connect he enters the credentials of UserB. In the audit you will find UserA as os_username and UserB as username.

This explains while you find oracle as os_username since this is the user that is used to run Oracle itself.