Which activity is audited by default and recorded in the operating system audit trail irrespective of whether or not database auditing is enabled?

Configuring unified auditing mode is an administrative action that is not automatically captured in the OS audit trail by default.

When a user connects with the SYSDBA or SYSOPER privilege, Oracle unconditionally records that activity to the operating system audit trail (the audit file destination), regardless of whether unified or traditional database auditing is enabled. This is a mandatory security control because SYSDBA access bypasses all database access controls, so an OS-level record that cannot be tampered with from within the database is required. This behavior is controlled by the AUDIT_SYS_OPERATIONS parameter, which defaults to TRUE in modern Oracle versions.

Issuing the AUDIT statement changes database audit policy but is itself not automatically written to the OS audit trail independent of database auditing settings.

Creating a fine-grained audit policy is a DDL operation inside the database and is not automatically captured in the OS audit trail by default.