A production route table changed unexpectedly. Which evidence most directly helps identify the responsible API operation and principal?

1. The application favicon request log alone.
2. A monthly CPU utilization chart.
3. OCI Audit records for the change.
4. The current subnet's address alone.