IMPORTANT: You may face system overhead/slow down issue after enabling audit.

Step 1: - Add initialization parameters & bounce instance:

audit_trail=true

audit_file_dest='/u01/app/oracle/PROD/adump/'

Step 2: - Enable auditing of failed logion attempts as SYSDBA:

SQL> audit create session whenever not successful;

Step 3: - You can now view failed login attempts in dba_audit_trail:

select
   os_username,
   username,
   terminal,
   to_char(timestamp,'MM-DD-YYYY HH24:MI:SS')
from
   dba_audit_trail;

OS_USERNAME     USERNAME        TERMINAL        TO_CHAR(TIMESTAMP,'
--------------- --------------- --------------- -------------------
oracle         anup              app01           05-16-2009 16:21:13