Thanks for all you help. I found the problem. I neeed to run the audit sql command with the "by access" clause. The default is "by session" which summarizes all similar DML statements into a single "session rec" entry in the sys.aud$ table. I was running insert, update and delete statements and I was expecting one audit entry per sql dml statement. But since I had "by session" enabled, I was not seeing what I expected. Running the audit command again with the "by access" clause got me what I wanted. Syntax: audit insert table, update table, delete table by access; -- Lyndon Tiu -- http://www.freelists.org/webpage/oracle-l