Originally posted by pando
it´s obvious you have not read the docs
quote:

Events Audited by Default
Regardless of whether database auditing is enabled, Oracle will always audit certain database-related actions into the operating system audit trail. These events include the following:

Instance startup

An audit record is generated that lists the OS user starting the instance, the user's terminal identifier, the date and time stamp, and whether database auditing was enabled or disabled. This is stored in the OS audit trail because the database audit trail is not available until after startup has successfully completed. Recording the state of database auditing at startup also prevents an administrator from restarting a database with database auditing disabled (so they can perform unaudited actions).

I'm starting to understand this aspect of auditing, but I don't see the information about whether auditing was disabled or enabled at startup in the audit file. The only I see in the audit record about the startup is this:

....
Wed Jan 5 12:34:24 2005
ACTION : 'STARTUP'
DATABASE USER: '/'
PRIVILEGE : SYSDBA
CLIENT USER: jsmith
CLIENT TERMINAL: Not Available
STATUS: 0
...

So where's the info about auditing being on or off at startup??