The database in question is an 11.2.0.4 2-node RAC read-only standby database
on Exadata, Starting this evening, OEM began raising 'Event
name=audit_failed_logins2:failed_login_count', reporting hundreds of failed
login attempts. Of course OEM does not provide any additional information, so
it remains a mystery.
The primary and standby databases are both auditing failed connections, so I
searched through the *.aud files on both nodes of the standby database and
didn't find any clues.
What should we check next?
Regards,
Doug
