My ADMIN account (and a few others) keep getting locked every 1-2 days. Is there a way to view where the login attempts that cause the lock are coming from?
I used:
select *
from UNIFIED_AUDIT_TRAIL
where action_name='LOGON'
and dbusername = 'ADMIN'
but there are only a few records with return code 28000. There is nothing to indicate that this account is used by some bot that tries to login every x minutes.
There is a public endpoint for this service (it's not a production environment, just used for demo purposes and easy access from anywhere), like
xxxxxxxxxxxxxxxxxxxx.adb.us-ashburn-1.oraclecloudapps.com/ords/admin/_sdw/