Description
If your Oracle database is configured for auditing, this alert will monitor for logon failures. It runs once every hour and looks for logon failures from the last hour.
ALERT DEFINITION
To create the alert, click on Alerts > Manage Alerts tab and create a Custom Alert of type Custom SQL Alert - Single Numeric Return. Configure the alert with values similar to these:
Alert Name: Login Failures
Execution Interval: 10 Minutes
Notification Text: There were login failures within the last 10 minutes
SQL Statement:
select count(*)
from dba_audit_session
where action_name = 'LOGON'
and returncode = 0
and timestamp > sysdate - (#FREQUENCY# / 1440)
Execute Against: Monitored Instance
Units: Logon Failures
High Threshold: Min 5, Max empty
Medium Threshold: Min 1, Max 5
