On the other day when I got to the office I was called to check a database that was running slow. They had implemented a new process there and wanted to make sure it was not impacted.
When checked I saw this issue using OEM
User SYS causing a strange wait event Failed Logon Delay
Someone had created a process running with the user SYS but they did not fully configured and a part of the process was trying to connect with the wrong password.
While they were looking in the configuration files and servers to see from where the issue was coming from, I started my own investigation to speed up the process.
1st I had to enable audit as it was disabled for unsuccessful loging attemps
SQL> audit session whenever not successful; Audit succeeded.
Than I was able to see from where the failed connection came from, I just needed to look for the return code 1017 as ORA-1017 is invalid username/password; logon denied on sys.aud$
col ntimestamp# for a30 heading "Timestamp" col userid for a6 heading "Username" col userhost for a15 heading "Machine" col spare1 for a10 heading "OS User" col comment$text for a80 heading "Details" select ntimestamp#, userid, userhost, spare1, comment$text,returncode from sys.aud$ where returncode=1017 or returncode=28000;
Oldie but goldie =)
Hope it helps,