Strange issue on deleting some rows on SYS.AUD$ table

Question

I just found out this strange thing happened on my 10gR2 database. I created a user called AUDIT_LOG and GRANT DELETE, REFERENCES, SELECT ON SYS.AUD$ TO AUDIT_LOG when I logged on as SYS dba.
(1) Then I logged on as AUDIT_LOG user, tested the following statements:
SELECT count(*) from sys.aud$ where ntimestamp# < TRUNC (SYSDATE-14);
COUNT(*)
2
DELETE from sys.aud$ where ntimestamp# < TRUNC(SYSDATE-14);
0 rows deleted
(2) When I logged on as SYS account, SYS deleted them all,
DELETE from sys.aud$ where ntimestamp# < TRUNC(SYSDATE-14);
2 rows deleted
I don't understand why the AUDIT_LOG user can't delete that two rows?
Thanks for your help!
lixidon

Answer 1

Apologies for misreading the first time. I am wondering if the rows in question were related to audit actions on sys.aud$ itself as those rows should not be deleted by the AUDIT_LOG user (even if the user has been granted delete).
Here's an excerpt from the Security Guide under the "Protecting the Standard Audit Trail" section:
Audit records generated as a result of object audit options set for the SYS.AUD$ table can only be deleted from the audit trail by someone connected with administrator privileges, which itself has protection against unauthorized use.
Here's a quick example illustrating this:
SQL> connect / as sysdba
Connected.
SQL> grant delete, references, select on sys.aud$ to scott;
Grant succeeded.
SQL> connect scott/tiger
Connected.
SQL> select count(*) from sys.aud$ where sessionid = 30002;
  COUNT(*)
         2
1 row selected.
SQL> delete from sys.aud$ where sessionid = 30002;
2 rows deleted.
SQL> commit;
-- now try to delete the sys.aud$ rows related to the above delete
-- this will not succeed as user scott even though delete has been granted
-- the session that performed the delete is 422426
SQL> select count(*) from sys.aud$ where obj$name = 'AUD$' and action# = 7 and sessionid = 422426;
  COUNT(*)
         2
1 row selected.
SQL> delete from sys.aud$ where obj$name = 'AUD$' and action# = 7 and sessionid = 422426;
0 rows deleted.
SQL>Regards,
Mark