oracle list invalid password logon denied
-- Detects invalid password fails (ORA-01017)
SELECT username,
os_username,
userhost,
client_id,
trunc(timestamp),
count(*) as failed_logins
FROM dba_audit_trail
WHERE returncode = 1017
AND --1017 is invalid username/password
timestamp > sysdate - 30
GROUP BY username, os_username, userhost, client_id, trunc(timestamp);