Search notes:

Oracle: SYS.AUD$

aud$ is populated if audit_trail is set to db or db,extended.
select
   ntimestamp#            , -- new timestamp (in UTC) of query (compare with obsoleted timestamp#)
   current_user           , -- Current user
   spare1          os_user, -- OS user name
   sessionid              , -- server session id
   entryid                , -- serial number to audit records
   sqltext                , -- sql text of the query, only populated if audit_trail is set with "db,extended"
   sqlbind                , -- bind variables for the query, only populated if audit_trail is set with "db,extended"
   statement              , -- sql statement number
   userid                 , -- database username
   userhost               , -- client host machine name
   terminal               , -- client terminal id
   action#                , -- action responsible for auditing
   returncode             , -- return code for the action
   obj$creator            , -- schema where object resides
   obj$name               , -- name of the object
   auth$grantee           , -- grantee username
   new$owner              , -- schema of the dependent object
   new$name               , -- name of the dependent object
   ses$actions            , -- success/failure of each action
   ses$tid                , -- object id
   logoff$lread           , -- number of logical reads in the session
   logoff$pread           , -- number of physical reads in the session
   logoff$lwrite          , -- number of logical writes in the session
   logoff$dead            , -- number of deadlocks in the session
   logoff$time            , -- session duration
   comment$text           , -- type authentication/trigger/protocol
   clientid               , -- user defined client identifier
   spare2                 , -- whether this table (aud$) is modified
   priv$used              , -- system privlege used
   sessioncpu             , -- total cpu time for the session
   proxy$sid              , -- proxy session serial number
   user$guid              , -- global user identifier
   instance#              , -- instance number
   process#               , -- OS process id
   xid                    , -- transaction identifier
   auditid                , -- audit operation id
   scn                    , -- SCN of the query
   dbid                   , -- database identifier for source db
   obj$edition            , -- Object edition name
   rls$info                 -- RLS related info
-- obj$label                -- OBSOLETE: 8.0 and above
-- ses$label                -- OBSOLETE: 8.0 and above
-- timestamp#               -- OBSOLETE: 10iR1 and above: time of query
-- auth$privilege           -- granted privileges
from
   sys.aud$
order by
   ntimestamp# desc
;

Misc

aud$ is not exported in full database export mode (MOS Note 745540.1).

Index