This is the script we use but you need admin rights.
Common return codes are:
1017 "invalid username/password; logon denied"
Invalid login attempt,locks the account by user's profile parameter FAILED_LOGIN_ATTEMPTS
28000 "the account is locked"
Account was already locked when the user tried. The script will show you the exact hour it was locked. Before the 28000 you should have at least 3 of the 1017 which was the user that locked it.
USERNAME "ORA USER", OS_USERNAME "OS USER", userhost,terminal,to_char(timestamp, 'YYYY-MON-DD HH24') Hour,returncode,count(*) "HOW MANY"
returncode != 0 and
username,OS_USERNAME, userhost,terminal, to_char(timestamp, 'YYYY-MON-DD HH24'), returncode