You probably will not be able to change anything with AUDIT_TRAIL init.ora parameter here.
When you connect as INTERNAL or as SYSDBA/SYSOPER, Oracle allways records this in a operating system's audit trial, even if you have database auditing disabled.
If you are on NT/2000 then probably your event log file is full. Clean or make more space to your event log with Event Viewer, priviledged database accesses are recorded in ApplicationLog part of event log.
On Unix check the directory $ORACLE_HOME/rdbms/audit (or whatever you have set in AUDIT_FILE_DEST init.ora parameter) to see if it is full or if Oracle's owner quota on it has been exceeded.
[Edited by jmodic on 02-16-2002 at 03:49 PM]
ASCII a stupid question, get a stupid ANSI
24 hours in a day .... 24 beer in a case .... coincidence?