EM Event: Number of failed login attempts exceeds threshold value [Part 1]

Hello!
Just got this error? Very simple to check. Below the easy solution using audit:

Activating audit to failed logins:

SQL> audit session whenever not successful;

Audit succeeded.

Then wait some time and check:

SQL> select * from (select
os_username,
username,
terminal,
to_char(timestamp,'MM-DD-YYYY HH24:MI:SS'),
returncode
from
dba_audit_trail where
returncode > 0 order by timestamp desc) where rownum<30; 2 3 4 5 6 7 8 9

OS_USERNAME USERNAME TERMINAL TO_CHAR(TIMESTAMP,' RETURNCODE
-------------------- -------------------- --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ------------------- ----------
SYSTEM TESTUSER unknown 10-04-2016 18:17:01 1017
SYSTEM TESTUSER unknown 10-04-2016 18:17:01 1017
SYSTEM TESTUSER unknown 10-04-2016 18:17:00 1017
SYSTEM TESTUSER unknown 10-04-2016 18:17:00 1017
SYSTEM TESTUSER unknown 10-04-2016 18:16:00 1017
SYSTEM TESTUSER unknown 10-04-2016 18:16:00 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:59 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:59 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:58 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:57 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:56 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:56 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:55 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:55 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:54 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:54 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:53 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:53 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:52 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:51 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:50 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:50 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:49 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:49 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:48 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:48 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:47 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:47 1017
SYSTEM TESTUSER unknown 10-04-2016 18:15:46 1017

Ok, but what this returncode means?

SQL> ! oerr ora 1017
01017, 00000, "invalid username/password; logon denied"
// *Cause:
// *Action:

Ok!
Now you know you are getting error because of invalid password (ORA-1017). Please check your application layer to fix it.
You also can find error you can get is ORA-28000 that indicates that account is locked.

Now, deactivating failed logins:

SQL> noaudit session whenever not successful;

Noaudit succeeded.

Cool! 🙂

In the next post I’ll share a different way to get this information, without using AUDIT solution. Wait for it!

See you!