Dianna, You can filter AUD$ table to show only "ORA-01017: invalid username/password; logon denied" errors: select userid, userhost, terminal, returncode from sys.aud$ where returncode=1017; regards On 28 April 2011 13:27, Dianna Gibbs <DIANNA.GIBBS@xxxxxxxxxxxxx> wrote: > We have a new application that is multi-tiered with connections coming from > many different windows and websphere servers. > > We’ve recently completed a new upgrade/install with several changes in > servers. Each environment has four databases, > > so we have a total of 16 databases for this application (TST, DEV,STG,PRD). > > > > Oracle 11.1.0.7 on AIX. > > > > Something is constantly locking an oracle user account in two different > databases (one prd, one tst). > > > > I’m trying to troubleshoot which servers have the incorrect passwords. > We’ve looked at log files, etc. and vendor cannot determine. > > > > I’m looking at AUDIT SESSION and understand it will show both successful and > unsuccessful login attempts. > > > > I also saw the Login Trigger SYS_CONTEXT. > > > > I was wondering if someone had used either successful to catch unsuccessful > logins or had another suggestion on best way to monitor and > > troubleshoot this issue? We don’t need this turned on long-term, just until > we can catch which server has incorrect password. > > > > Thanks in advance for any time and suggestions. > > Dianna G. > > Please consider the environment before printing this e-mail > > This e-mail, facsimile, or letter and any files or attachments transmitted > with it contains > information that is confidential and privileged. This information is > intended only for the use of the > individual(s) and entity(ies) to whom it is addressed. If you are the > intended recipient, further > disclosures are prohibited without proper authorization. If you are not the > intended recipient, any > disclosure, copying, printing, or use of this information is strictly > prohibited and possibly a > violation of federal or state law and regulations. If you have received this > information in error, > please notify Children's Medical Center Dallas immediately at 214-456-4444 > or via e-mail at > privacy@xxxxxxxxxxxxxx Children's Medical Center Dallas and its affiliates > hereby claim all > applicable privileges related to this information. > > -- Ivan Ricardo Schuster OCP 10g/11g OCE RAC 10g/Linux -- //www.freelists.org/webpage/oracle-l