cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post

Custom Alert - Login Failures

Description

If your Oracle database is configured for auditing, this alert will monitor for logon failures. It runs once every hour and looks for logon failures from the last hour.

ALERT DEFINITION

To create the alert, click on Alerts > Manage Alerts tab and create a Custom Alert of type Custom SQL Alert - Single Numeric Return. Configure the alert with values similar to these:

Alert Name: Login Failures

Execution Interval: 10 Minutes

Notification Text: There were login failures within the last 10 minutes

SQL Statement:

select count(*)

from dba_audit_session

where action_name = 'LOGON'

and returncode = 0

and timestamp > sysdate - (#FREQUENCY# / 1440)

Execute Against: Monitored Instance

Units: Logon Failures

High Threshold: Min 5, Max empty

Medium Threshold: Min 1, Max 5

Labels (1)
Comments

returncode = 0 will return successful logons...  It should be != 0 or the specific error you are looking for (e.g. 1017).

Version history
Revision #:
1 of 1
Last update:
‎01-08-2014 07:38 AM
Updated by: