I want to audit users SYS, SYSTEM and other database users who have DBA role. Audit event is logon / logoff to / from the database. Please note that this is for Oracle 8.0.3, so I cannot use 8i feature of trigger using 'AFTER LOGON ON DATABASE'.
I think I have found it! I need to try it out and see if it works as intended. However, this method only gives username, logon & logoff time. I need osuser & machine atleast.
audit_trail = db
audit session by SYS, SYSTEM, JACK;
(JACK has the dba role).