If you are on a UNIX based system I would suggest checking both Oracle and the root cron jobs (again) for a job that is logging on with the system username. HTH -- Mark D Powell -- -----Original Message----- From: oracle-l-bounce@xxxxxxxxxxxxx [mailto:oracle-l-bounce@xxxxxxxxxxxxx] On Behalf Of J. Dex Sent: Wednesday, March 29, 2006 9:47 AM To: oracle-l@xxxxxxxxxxxxx Subject: dba_audit_session -- finding process? Is there anyway to map sessionid (or any other parameter) from dba_audit_session to a specific process to get more information on what it actually is that is running? My system password keeps locking up so I turned on auditing. I can see by error 1017 that it is due to invalid login/password but can't tell what is trying to access the database using the invalid login/password. We recently changed the password so I suspect it is a script but I am not sure. I am also open to any other ways of solving this problem. I recently took over this server and may just not know where all of the scripts, etc. are even though I thought I found everything. _________________________________________________________________ On the road to retirement? Check out MSN Life Events for advice on how to get there! http://lifeevents.msn.com/category.aspx?cid=Retirement -- //www.freelists.org/webpage/oracle-l -- //www.freelists.org/webpage/oracle-l