审计用户登录密码错误

oracle 11g，先确保审计开关打开

配置审计需要重启实例
SQL> alter system set AUDIT_TRAIL = DB scope=spfile; 
SQL> shutdown immediate 
SQL> startup

确认审计表存在
desc aud$

开启审计
SQL>AUDIT CREATE SESSION BY ACCESS WHENEVER NOT SUCCESSFUL;
SQL>AUDIT CONNECT BY ACCESS WHENEVER NOT SUCCESSFUL


观察3天（等鱼上钩）
alter session set NLS_DATE_FORMAT='YYYY-MM-DD HH24:MI:SS';
select username,os_username,userhost,client_id,trunc(timestamp),count(*) failed_logins
from dba_audit_trail
where returncode=1017 and --1017 is invalid username/password
timestamp < sysdate -7
group by username,os_username,userhost, client_id,trunc(timestamp);