Applicable Delphix Versions
Oracle systems connected to a Delphix Engines have audit files generated in $ORACLE_HOME/rdbms/admin with the following naming scheme
These files will have similar content to the following
System name: Linux Node name: rh73-ora-src Release: 3.10.0-514.el7.x86_64 Version: #1 SMP Wed Oct 19 11:24:13 EDT 2016 Machine: x86_64 Storage: ? Instance name: delphix_sid Redo thread mounted by this instance: 0 <none> Oracle process number: 0 Unix process pid: 14313, image: Mon Aug 28 22:35:14 2017 -07:00 LENGTH : '160' ACTION : 'CONNECT' DATABASE USER: '/' PRIVILEGE : 'SYSDBA' CLIENT USER: 'ora12102' CLIENT TERMINAL: 'Not Available' STATUS: '0' DBID: ''
There will be multiple files generated every time the monitor runs.
Oracle RDBMS will create audit files for all attempts to connect "as sysdba" to an instance that is not running to the following directories, in order of preference. This fuctionality cannot be disabled.
As part of the Environment Monitoring, the Delphix Engine will regularly check that the environment user is able to start sqlplus and connect "as sysdba". This is done by setting an ORACLE_SID of "delphix_id", then attempting to execute "sqlplus / as sysdba". It is this action that results in the Oracle auditing facility generating the mentioned files.
This is normal and expected behavior from both the Delphix Engine and Oracle RDBMS. Oracle note 1299033.1 covers the details for Oracle Auditing, including this behavior.
These files should be manually or automatically removed as dictated by your organizations auditing policy.