I would not say that this is normal. The syslog output format may be dependent on your particular flavor of UNIX, or your particular syslog configuration. The systems I have tested this on (RHEL 5, RHEL 6, OEL 5) all include the trailing quote, as well as several more fields (see below). I would recommend checking your syslog or rsyslog configuration to make sure there isn't some issue there. It may also be that Oracle is sending a character that has special meaning to syslog that causes it to truncate the entry. Check the full SQL statement being used to see if there is anything unusual about it. Dec 3 14:46:31 hostname Oracle Audit[11872]: LENGTH : '233' ACTION :[85] 'alter system set "_shutdown_completion_timeout_mins" = 30 scope=memory /* db agent */' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[10] '1773000810' ... View more