Use this :

create or replace trigger sys_test
after logon on database
begin
if user = 'SYS' then -- do something
null;
end if;
end;
/