答案来自metalink，对于windows系统，对sys用户的审计信息并不存在AUDIT_FILE_DEST参数指定的目录里，而是在windows的事件管理器中。
(Navigation Path: Computer Management -> Event View -> Windows Logs -> Application)
本机audit参数设置（对于windows ，审计sys用户只需要设置audit_sys_operations为true即可；unix还需audit_file_dest）：
SQL> show parameter audit
NAME TYPE VALUE
------------------------------------ --------------------------------- ------------------------------
audit_file_dest string D:\ORACLE\PRODUCT\10.2.0\ADMIN\ORCL\ADUMP
audit_sys_operations boolean TRUE
audit_trail string DB
SQL>
metalink解释：
Exception: As 'AUDIT_FILE_DEST' is invalid on Windows, all Oracle audit trail information on Windows is recorded in the Windows event viewer.
Audit SYS User Operations [ID 174340.1]