OEM reporting failed login attempts on read-only physical standby database
From: DOUG KUSHNER <dougk5_at_cox.net>
Date: Fri, 24 Jun 2022 02:21:29 -0700 (MST)
Message-ID: <990983875.604442.1656062489640_at_myemail.cox.net>
The database in question is an 11.2.0.4 2-node RAC read-only standby database on Exadata, Starting this evening, OEM began raising 'Event name=audit_failed_logins2:failed_login_count', reporting hundreds of failed login attempts. Of course OEM does not provide any additional information, so it remains a mystery.
Date: Fri, 24 Jun 2022 02:21:29 -0700 (MST)
Message-ID: <990983875.604442.1656062489640_at_myemail.cox.net>
The database in question is an 11.2.0.4 2-node RAC read-only standby database on Exadata, Starting this evening, OEM began raising 'Event name=audit_failed_logins2:failed_login_count', reporting hundreds of failed login attempts. Of course OEM does not provide any additional information, so it remains a mystery.
The primary and standby databases are both auditing failed connections, so I searched through the *.aud files on both nodes of the standby database and didn't find any clues.
What should we check next?
Regards,
Doug
-- http://www.freelists.org/webpage/oracle-lReceived on Fri Jun 24 2022 - 11:21:29 CEST