If you do not see a problem on either the primary or secondary instance have you considered restarting OEM then looking to see if the error still shows?
Mark Powell
Database Administration
(313) 592-5148
From: oracle-l-bounce_at_freelists.org <oracle-l-bounce_at_freelists.org> on behalf of DOUG KUSHNER <dougk5_at_cox.net>
Sent: Friday, June 24, 2022 5:21 AM
To: oracle-l_at_freelists.org <oracle-l_at_freelists.org>
Subject: OEM reporting failed login attempts on read-only physical standby database
The database in question is an 11.2.0.4 2-node RAC read-only standby database on Exadata, Starting this evening, OEM began raising 'Event name=audit_failed_logins2:failed_login_count', reporting hundreds of failed login attempts. Of course OEM does not provide any additional information, so it remains a mystery.
The primary and standby databases are both auditing failed connections, so I searched through the *.aud files on both nodes of the standby database and didn't find any clues.
What should we check next?
Regards,
Doug
