Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
In a database there is a username called u1, someone tried to access u1 but due to wrong password it got locked. How to find who did this suspicious activity.
You can find information about connection in listener.log
Location is under $ORACLE_HOME/diag/ or $ORACLE_HOME/network/log
IF you really want to know who locked the account you should turn on auditing for failed connections. The listener.log file will show connections, it won't show which connections failed.
Required, but never shown