DB version: 19c
OS : RHEL 7.9
Standalone DB
I got an OEM alert which says "Number of failed login attempts exceeds threshold value".
The alert is for a CDB not PDB.
When I login to CDB$ROOT and query unified_audit_trail, I see that the last time "ORA-01017: invalid username/password; logon denied" error encountered in this DB was 10 days back.
Then, why did i get this OEM alert ?
I grepped for ORA-1017 in the DB alert log and listener.log. There are no occurrences of ORA-01017 in either of the file.
How can I find which user is causing this issue ?
SQL> select DBUSERNAME, event_timestamp from unified_audit_trail where action_name = 'LOGON' AND RETURN_CODE = 1017 order by event_timestamp desc;
DBUSERNAME EVENT_TIMESTAMP
----------------------------------- ---------------------------------------------------------------------------
MNHSYNCBNC01 18-JUN-24 12.05.25.450838 PM
05-MAY-24 09.33.02.986938 AM
03-MAY-24 01.31.39.213022 PM
03-MAY-24 09.56.41.333193 AM
20-APR-24 07.02.19.104244 PM
20-APR-24 10.31.44.176113 AM
12-NOV-23 07.17.09.866765 AM
11-NOV-23 10.37.45.737698 AM
17-OCT-23 06.37.36.083480 AM
16-OCT-23 10.12.15.418017 AM
13-JUN-23 07.52.28.611704 AM
12-JUN-23 08.11.18.837970 PM
SYS 12-JUN-23 01.28.19.089736 PM
C##GGATE 12-JUN-23 01.25.15.211874 PM
SYS 09-JUN-23 01.55.16.142521 AM
<snipped>