Auditing

Show the audit trail (12c)

select dbusername
,      event_timestamp
,      sql_text
from   unified_audit_trail

The Unified Audit Trail is well protected. Not even SYS can mess with it.

select table_name from dba_tables where owner='AUDSYS';

TABLE_NAME
--------------------------------------------------------------------------------------------------------------------------------
CLI_SWP$4f81f886$1$1


SYS@RMANV12> truncate table audsys."CLI_SWP$4f81f886$1$1";
truncate table audsys."CLI_SWP$4f81f886$1$1"
                      *
ERROR at line 1:
ORA-55941: DML and DDL operations are not allowed on table "AUDSYS"."CLI_SWP$4f81f886$1$1"

SYS@RMANV12> drop user audsys cascade;
drop user audsys cascade
*
ERROR at line 1:
ORA-28050: specified user or role cannot be dropped

The only way to work with the audit trail is with the DBMS_AUDIT_MGMT package.