Hi Sam and the rest ,
I think with sam's method, I'm on the right way to capture the culprit.

One last question.
When I went through the ORACLE_HOME, I found out that, the
default audit trail were a lot(i mean a lot) so I could not really narrow down the time stamp. Do you know of any easier way to narrow the time stamp?

This is what I did:
cd $ORACLE_HOME/rdbms/audit
ls

ora_29944.aud ora_43866.aud ora_56872.aud ora_9304562.aud
ora_29946.aud ora_43922.aud ora_56882.aud ora_9305594.aud
ora_30202.aud ora_43934.aud ora_56890.aud ora_9308434.aud
ora_30442.aud ora_44150.aud ora_56898.aud ora_9312820.aud
ora_30466.aud ora_44368.aud ora_56914.aud ora_9316174.aud
ora_30482.aud ora_44896.aud ora_56922.aud ora_9319786.aud
ora_30978.aud ora_44902.aud ora_56928.aud ora_93226.aud
ora_30982.aud ora_45158.aud ora_57046.aud ora_9323398.aud
ora_31068.aud ora_45354.aud ora_57050.aud ora_9327010.aud
ora_31074.aud ora_45428.aud ora_57056.aud ora_94744.aud
ora_31224.aud ora_45476.aud ora_57134.aud ora_94750.aud
ora_31276.aud ora_45684.aud ora_57280.aud ora_94958.aud
ora_31744.aud ora_45728.aud ora_57282.aud ora_95916.aud
ora_31994.aud ora_45730.aud ora_57288.aud ora_96880.aud
ora_32082.aud ora_45860.aud ora_57290.aud ora_97762.aud
ora_32090.aud ora_45924.aud ora_57292.aud ora_97944.aud
ora_32098.aud ora_45930.aud ora_57296.aud ora_9796.aud
ora_32106.aud ora_45932.aud ora_57314.aud ora_98046.aud
ora_32114.aud ora_45938.aud ora_57344.aud ora_98424.aud
ora_32134.aud ora_46088.aud ora_57350.aud ora_98430.aud
ora_32196.aud ora_46094.aud ora_57356.aud ora_99546.aud



NOTE: THIS IS JUST AN EDITED VERSION.
IS THERE AN EASIER WAY TO FIND THE TIME STAMP? OR I HAVE TO GO THROUGH EACH OF THEM INDIVIDUALLY?




thanks,
Clinton