parsing and purpose of oracle audit (.aud) logs I am looking at the oracle audit logs and am trying to understand and parse.

The format appears to be consistent:

Date
Length:
Action:
...etc


My questions are: 1) what generates these? Is it every sql command executed against the db? 2) how can i parse these into a consistent format (xml/json/csv)

Thank you.
1) Audits are performed on actions you define.
For example: audit all by testing by access will audit everything that the user testing does.

2) I think you should look into XML auditing. Source
Example:
Set up your database by issuing alter system set audit_trail='XML, EXTENDED';
This modification does require a DB restart.
After you set that you'll notice your audit files start coming in a format that looks like this:  

&lt;?xml version="1.0" encoding="UTF-8" ?&gt; 
&lt;Audit xmlns="http://xmlns.oracle.com/oracleas/schema/dbserver_audittrail-10_2.xsd" xmlns:
xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/
oracleas/schema/dbserver_audittrail-10_2.xsd"&gt;
  &lt;Version&gt;10.2&lt;/Version&gt; 
  &lt;AuditRecord&gt;
    &lt;Audit_Type&gt;1&lt;/Audit_Type&gt; 
    &lt;Session_Id&gt;108802&lt;/Session_Id&gt; 
    &lt;StatementId&gt;9&lt;/StatementId&gt; 
    &lt;EntryId&gt;1&lt;/EntryId&gt; 
    &lt;Extended_Timestamp&gt;2005-10-09T00:20:02.284327&lt;/Extended_Timestamp&gt; 
    &lt;DB_User&gt;SCOTT&lt;/DB_User&gt; 
    &lt;OS_User&gt;oracle&lt;/OS_User&gt; 
    &lt;Userhost&gt;prolin1&lt;/Userhost&gt; 
    &lt;OS_Process&gt;22158&lt;/OS_Process&gt; 
    &lt;Terminal&gt;pts/3&lt;/Terminal&gt; 
    &lt;Instance_Number&gt;0&lt;/Instance_Number&gt; 
    &lt;Object_Schema&gt;BANK&lt;/Object_Schema&gt; 
    &lt;Object_Name&gt;ACCOUNTS&lt;/Object_Name&gt; 
    &lt;Action&gt;103&lt;/Action&gt; 
    &lt;Returncode&gt;0&lt;/Returncode&gt; 
    &lt;Scn&gt;6447392335&lt;/Scn&gt; 
    &lt;SesActions&gt;---------S------&lt;/SesActions&gt; 
  &lt;/AuditRecord&gt;
&lt;/Audit&gt;


Once its in that format you'll find that you can do just about anything with it you like. Personally I send them to splunk for indexing, parsing, and handy searching.
Best of luck!