SQL> create audit policy test_audit_logon privileges create session;

Audit policy created.

SQL> 
SQL> audit policy test_audit_logon;

Audit succeeded.

SQL> 
SQL> conn /@ora12
Connected.
SQL> 
SQL> exec dbms_audit_mgmt.flush_unified_audit_trail

PL/SQL procedure successfully completed.

SQL> 
SQL> select client_program_name
  2    from unified_audit_trail
  3   where event_timestamp>systimestamp-interval'10' second
  4  	and unified_audit_policies='TEST_AUDIT_LOGON' ;

CLIENT_PROGRAM_NAME
--------------------------------------------------------------------------------
sqlplus@xxx (TNS V1-V3)