We have mechanism to lock the ID after 10 consecutive wrong attempts.
I want to implement a script which will find out which user did this.
I want to find out the record for returncode = 1017 rows right before the id locked (Returncode=28000)
how can I get that ... can anyone help ?
Data dictionary view DBA_AUDIT_SESSION keeps track of the Account Lock event.
Returncode :
ORA-01017: invalid username/password; logon denied
and
ORA-28000: the account is locked
I was trying something like this ...
select OS_USERNAME, USERNAME , USERHOST, RETURNCODE, TIMESTAMP
from dba_audit_session
where to_date(TIMESTAMP, 'DD-Mon-YY') in (select to_date(TIMESTAMP, 'DD-Mon-YY')
from dba_audit_session
where to_date(TIMESTAMP,'DD-Mon-YY') = to_date(sysdate, 'DD-Mon-YY'))
and RETURNCODE = 28000;