In Oracle DB 11.2g, is it possible for the audit trail to explicitly mention account locking events?

Question

As it is, the audit trail will show login failures, and an attempt to log into a locked account (ORA-01017 and ORA-28000). What I would like to know is if it's possible for it to make a mention when the locking itself happens, not just in response to a user's actions.

So ideally it will say something to the effect of:

user login attempt failed
user login attempt failed
user login attempt failed
user account has been locked for multiple login failures

Is something like this possible?

Answer 1

I do not think it is possible. The AUDIT_ACTIONS table contains all possible actions in the audit trail. There is a LOCK action, but that refers to LOCK TABLE.

The LOCK_DATE column in DBA_USERS contains this information though.