Don't forget your friendly flatfile listener.log, which in recent versions of Oracle can be setup as an external table to be read from the DB directly. Because of the nature of the listener, it can't know if a connection is successful or not, just that one was attempted. Also note that all bets are off for just about any useful logging information if the client is using JDBC thin to connect. Rich -----Original Message----- From: oracle-l-bounce@xxxxxxxxxxxxx [mailto:oracle-l-bounce@xxxxxxxxxxxxx] On Behalf Of Ethan Post Sent: Thursday, December 01, 2005 10:20 AM To: jametong@xxxxxxxxx Cc: Oracle-L@xxxxxxxxxxxxx Subject: Re: Can IP addresses be audited in Oracle I believe the hostname or IP is in DBA_AUDIT_TRAIL when you AUDIT SESSION. This is the only way to get the info for a failed logon attempt AFAIK. On 12/1/05, jame tong <jametong@xxxxxxxxx> wrote: you can use logon triggers to record the context of the logon event.