Couple things you could do:

- You could set an environment that keeps separate shell histories for any user that su's to oracle. Ex: make user oracle's shell ksh, then make .profile writable to root only. In .profile, set HISTFILE to something like .sh_history.$USER. You can script the retrieval of the user name or, something I saw implemented before, you give the users a code they need to enter, which will match their usernames.

You could make the oracle account accessible to only one user at the time. Same deal, whatever .profile or .bashrc, you make writable to root only. Inside, script a check to see if anyone is already su'd to oracle. If so, kill the session. Then you can simply use sulog and the oracle user's shell history.