I believe that on Linux (maybe all UNIX platforms?), the only(?) way to audit activity in the Oracle database is to send it to a log file. Therefore, we use the Oracle Auditor - Syslog connector to accomplish this.
I believe that the Oracle Auditor - Windows connector does the same thing with Oracle on the Windows platform.
I don't know anything about the Oracle Auditor - Database connector but if you start to configure it, you'll notice that is prompts for credentials to the Oracle database as well as time between queries. I haven't tested it myself but if I had to guess, it probably logs into Oracle every so often and queries the built-in audit table for the latest batch of events.