Hello!
Just got this error? Very simple to check. Below the easy solution using audit:
Activating audit to failed logins:
SQL> audit session whenever not successful; Audit succeeded.
Then wait some time and check:
SQL> select * from (select os_username, username, terminal, to_char(timestamp,'MM-DD-YYYY HH24:MI:SS'), returncode from dba_audit_trail where returncode > 0 order by timestamp desc) where rownum<30; 2 3 4 5 6 7 8 9 OS_USERNAME USERNAME TERMINAL TO_CHAR(TIMESTAMP,' RETURNCODE -------------------- -------------------- --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ------------------- ---------- SYSTEM TESTUSER unknown 10-04-2016 18:17:01 1017 SYSTEM TESTUSER unknown 10-04-2016 18:17:01 1017 SYSTEM TESTUSER unknown 10-04-2016 18:17:00 1017 SYSTEM TESTUSER unknown 10-04-2016 18:17:00 1017 SYSTEM TESTUSER unknown 10-04-2016 18:16:00 1017 SYSTEM TESTUSER unknown 10-04-2016 18:16:00 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:59 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:59 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:58 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:57 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:56 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:56 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:55 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:55 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:54 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:54 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:53 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:53 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:52 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:51 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:50 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:50 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:49 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:49 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:48 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:48 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:47 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:47 1017 SYSTEM TESTUSER unknown 10-04-2016 18:15:46 1017
Ok, but what this returncode means?
SQL> ! oerr ora 1017 01017, 00000, "invalid username/password; logon denied" // *Cause: // *Action:
Ok!
Now you know you are getting error because of invalid password (ORA-1017). Please check your application layer to fix it.
You also can find error you can get is ORA-28000 that indicates that account is locked.
Now, deactivating failed logins:
SQL> noaudit session whenever not successful; Noaudit succeeded.
Cool! 🙂
In the next post I’ll share a different way to get this information, without using AUDIT solution. Wait for it!
See you!