Re: OEM reporting failed login attempts on read-only physical standby database

Hmmm...
Audit session whenever not successful;

https://www.netwrix.com/how_to_track_down_failed_oracle_logon_attempts.html

D

On Fri, Jun 24, 2022, 2:21 AM DOUG KUSHNER <dougk5_at_cox.net> wrote:

> The database in question is an 11.2.0.4 2-node RAC *read-only standby*
> database on Exadata, Starting this evening, OEM began raising 'Event
> name=audit_failed_logins2:failed_login_count', reporting hundreds of failed
> login attempts. Of course OEM does not provide any additional information,
> so it remains a mystery.
>
> The primary and standby databases are both auditing failed connections, so
> I searched through the *.aud files on both nodes of the standby database
> and didn't find any clues.
>
> What should we check next?
>
> Regards,
> Doug
>
>
>

--
http://www.freelists.org/webpage/oracle-l