what your saw is exactly what pando is referring to
I can see that database startup is audited to the OS. But Pando also stated that the OS audit record would include whether Auditing was disabled or enabled at database startup.


So Again, I repeat...

Where in the audit record (as I previously listed) does it indicate whether Auditing was enabled OR disabled at database startup???