Hm, Sam, why do you have a feeling he is doing anything connected as SYS here? I can't see any clue that leads to that conclusion. Because he is using svrmgrl? That means absolutely nothing, he can be connected as SCOTT, SYSTE, SYS or whatever user...