DB Wiki

By default, from 11gR1, when a database is created using DBCA, the database auditing parameter will be turned on.

SQL> show parameter audit_trail

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_trail                          string      DB

This means whenever a connection is made to the database, an entry is logged in the Audit Trail.
Therefore the table sys.aud$ can grow very quickly and on web applications will affect performance

You can turn this off by entering the following as SYS user …

SYS> NOAUDIT CREATE SESSION WHENEVER SUCCESSFUL;

Noaudit succeeded.

This still means that failed logins are audited.

SQL below will show everything that has been audited today

alter session set nls_date_format = 'DD-MON-YYYY HH24:MI';
set linesize 160
col os_username format a20
col userhost format a25

select os_username, username, action, userhost, timestamp 
from dba_audit_trail 
where TIMESTAMP > trunc(sysdate)
order by timestamp;