A route table was changed unexpectedly. Which record most directly helps attribute the management operation?

1. OCI Audit events with caller and operation context.
2. Only an application HTTP access log.
3. The instance's average CPU graph.
4. Only the current route table text.