User SYS logged on from. Where I can find source of access? I´m receiving alerts from EM.

Host=Teste.com   
Target type=Database Instance  
Target name=REF.Teste.com  
Categories=Security  
Message=User SYS logged on from kali.  
Severity=Warning  
Event reported time=Mar 8, 2017 10:11:04 AM BRT  
Target Lifecycle Status=Production  
Comment=TI DEV-DV  
Operating System=Linux  
Platform=x86_64   
Event Type=Metric Alert  
Event name=UserAudit:username  
Metric Group=User Audit  
Metric=Audited User  
Metric value=SYS  
Key Value=SYS_kali  
Key Column 1=Audited User - Host  
Rule Name=Unavailability,Events   
Rule Owner=SYSMAN  
Update Details:  
User SYS logged on from kali.



Where I can find the logs of this audit user? 
"User SYS logged on from kali". What would this kali be?


thanks
Where I can find the logs of this audit user?
  


By default, audit logs for SYSDBA or SYSOPER privileges are stored on AUDIT_FILE_DEST directory.

SQL&gt; show parameter AUDIT_FILE_DEST

NAME                     TYPE         VALUE
------------------------ ----------- ------------------------------
audit_file_dest          string       /u01/app/oracle/admin/orcl/adump


For non-sys users, audit logs are stored in data dictionary table called `AUD$' and have several views to get these information.

SELECT view_name
FROM   dba_views
WHERE  view_name LIKE 'DBA%AUDIT%'
ORDER BY view_name;



  
  "User SYS logged on from kali". What would this kali be?
  


Kali is the host name/domain name from which the user way logged on to the database server.