Oracle Database / Accounts, Security & Access
Use authorized audit evidence to locate repeated failed logins
An account can relock because of a forgotten scheduled task or replica. Audit evidence can identify the source when the relevant auditing is enabled.
Environment and inputs: Oracle Database 19c baseline · SQL*Plus-compatible SQL unless RMAN, DGMGRL, ADRCI or a host shell is specified. Check release, patch level, edition and container first.
Start with this diagnostic
Use the stated SQL, RMAN, DGMGRL or host shell and replace sample names with approved targets. DBA and V$ views need authorized catalog access in the correct container. Do not grant broad privileges for an example.
SELECT event_timestamp, dbusername, userhost, return_code FROM unified_audit_trail WHERE dbusername = 'APP_USER' AND action_name = 'LOGON' AND event_timestamp > SYSTIMESTAMP - INTERVAL '1' HOUR ORDER BY event_timestamp DESC FETCH FIRST 50 ROWS ONLY;Read the result
On a database using the applicable unified audit policy, retained rows show recorded attempts. Absence does not prove no attempt occurred if auditing or retention differs.
Resolve and verify
Correlate host and time with application secret deployments and jobs. Repair the retrying source before an approved unlock or rotation.
Operational precautions
Audit data is sensitive and access should be narrowly granted. Bound the query to avoid scanning a large audit trail unnecessarily.