Oracle SYS Auditing with Audit Trail to DB I have an Oracle Database 11g R2 on Oracle Enterprise Linux. I have enabled SYS auditing as:

SQL&gt; ALTER SYSTEM SET audit_sys_operations=true SCOPE=spfile;

SQL&gt; ALTER SYSTEM SET audit_trail=OS SCOPE=spfile;

SQL&gt; SHUTDOWN IMMEDIATE

SQL&gt; STARTUP

The audit information is storing in adump folder. But I want to set audit trail to Database(i-e: in SYS.AUD$). I have tried this:

SQL&gt; ALTER SYSTEM SET audit_trail=DB SCOPE=spfile;

SQL&gt; SHUTDOWN IMMEDIATE

SQL&gt; STARTUP

but after this setting, audit records are not going to SYS.AUD$ but instead these are going to operating system adump folder. So how can I set audit trail to database?
This is expected behaviour SYS auditing will always go to the filesystem.

The documentation for AUDIT_FILE_DEST states:


  Oracle Database also writes mandatory auditing information to this
  location, and if the AUDIT_SYS_OPERATIONS initialization parameter is
  *set, writes audit records for user SYS*.


... and the documentation for AUDIT_SYS_OPERATIONS states:


  Enables or disables the auditing of top-level operations directly
  issued by user SYS, and users connecting with SYSDBA or SYSOPER
  privilege. Oracle Database writes the audit records to the audit trail
  of the operating system. If you set the AUDIT_TRAIL initialization
  parameter to XML or XML, EXTENDED, it writes the audit records in XML
  format. On UNIX systems, if you have also set the AUDIT_SYSLOG_LEVEL
  parameter, then it overrides the AUDIT_TRAIL parameter, which writes
  the SYS audit records to the system audit log using the SYSLOG
  utility.


Documentation link here.