I am currently auditing logins and the audit logs are going directly to a syslog server. We have an application that maintains its own security and logs into Oracle with an application id (app_user). Oracle is capturing these logins as for app_user. Is there someway I can use sys_context( 'USERENV' , 'OS_USER' ) to have auditing record the OS user login instead of app_user? Thanks Randy