After moving Oracle 11.2g database into the another RAC cluster we faced a lot of failed login attempts into Grid Control. We needed to know where these login attempts are coming. And with following sql we did get enough information to tackle these logins:
select to_char(TIMESTAMP,'YYYY-MM-DD HH24:MI:SS') tstamp ,OS_USERNAME,USERNAME,USERHOST,ACTION_NAME, TERMINAL from DBA_AUDIT_SESSION where returncode = 1017 order by 1;
returncode 1017 stands for Oracle error "invalid username/password; logon denied"
and thats why we get those failed login attemps with it.
No comments:
Post a Comment