select 
  xmlroot(
    xmlelement("SESSIONS"
      , xmlagg(
        xmlelement("SESSION"
          , xmlattributes(sessionid as id)
            , xmlagg(
              xmlelement("ENTRY"
                 ,xmlattributes(entryid as id),
                    xmlforest(
                       statement
                      , timestamp#
                      , userid
                      , userhost
                      , terminal
                      , action#
                      , returncode
                      , obj$creator
                      , obj$name
                      , auth$privileges
                      , auth$grantee
                      , new$owner
                      , new$name
                      , ses$actions
                      , ses$tid
                      , logoff$lread
                      , logoff$pread
                      , logoff$lwrite
                      , logoff$dead
                      , logoff$time
                      , comment$text
                      , clientid
                      , spare1
                      , spare2
                      , obj$label
                      , ses$label
                      , priv$used
                      , sessioncpu
                      , ntimestamp#
                      , proxy$sid
                      , user$guid
                      , instance#
                      , process#
                      , xid
                      , auditid
                      , scn
                      , dbid
                      , sqlbind
                      , sqltext
                      , obj$edition)
          ) order by entryid
        )
      )
    )
  ), version '1.0').GetClobVal()
from sys.aud$
--where ntimestamp# > timestamp '2019-10-10 00:00:00'
group by sessionid
;