In a database there is a username called u1, someone tried to access u1 but due to wrong password it got locked. How to find who did this suspicious activity.

  • Do you have auditing enabled? – Philᵀᴹ May 21 '14 at 8:28

You can find information about connection in listener.log Location is under $ORACLE_HOME/diag/ or $ORACLE_HOME/network/log

  • +1 but how canI find the sessions that do the wrong login? – miracle173 Jul 28 '14 at 22:02

IF you really want to know who locked the account you should turn on auditing for failed connections. The listener.log file will show connections, it won't show which connections failed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.