-- Detects invalid password fails (ORA-01017)
SELECT username,
       os_username,
       userhost,
       client_id,
       trunc(timestamp),
       count(*) as failed_logins
FROM dba_audit_trail
WHERE returncode = 1017
  AND --1017 is invalid username/password
    timestamp > sysdate - 30
GROUP BY username, os_username, userhost, client_id, trunc(timestamp);