SQL> ALTER SYSTEM SET audit_trail=db SCOPE=SPFILE;

System altered.

SQL> STARTUP FORCE
ORACLE instance started.

Total System Global Area  289406976 bytes
Fixed Size                  1301536 bytes
Variable Size             262677472 bytes
Database Buffers           25165824 bytes
Redo Buffers                 262144 bytes
Database mounted.
Database opened.

SQL> SHOW PARAMETER audit_trail

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_trail                          string      DB

SQL> AUDIT SESSION;

Audit succeeded.

SQL>
SQL> conn scott/tiger
Connected.
SQL> conn crap/crap
ERROR:
ORA-01017: invalid username/password; logon denied

Warning: You are no longer connected to ORACLE.
SQL> conn / as sysdba
Connected.

SQL>
SQL> SELECT username, action_name, returncode, to_char(timestamp, 'DD-MON-YYYY HH24:MI:SS') time
  2    FROM dba_audit_session
  3  /

USERNAME                       ACTION_N RETURNCODE TIME
------------------------------ -------- ---------- --------------------
SCOTT                          LOGOFF            0 17-AUG-2004 16:00:59
CRAP                           LOGON          1017 17-AUG-2004 16:01:00