Re: audit reporting

"Alan" <desertflowerln_at_yahoo.com> wrote in message news:b1217045.0405251540.72946e36_at_posting.google.com...
> One of the things I audit is the failed logon attampts.
> e.g. audit session whenever not successful;
>
> I can check the results from DBA_AUDIT_SESSION. But can I get
> alerts/notification on, say, 5 consective failed attemps? Does anyone
> have a trigger that can do that?

Well, it's not what you're after, but using profiles, you can set things up so that after the fifth failed login attempt, the user account is locked. You can also configure a time after which the account is automatically unlocked. But for the user to get unlocked before that automatic time elapses, they'd have to ring you and ask nicely... which is probably as much of an alert/notification as you could wish for, no??!

I guess what I'm really saying is: what is it that you want to achieve by the notification you're asking for? If it's that you really don't want or need the notification in its own right, but are merely concerned that 5 failed login attempts sounds like a hacking attempt which you want to thwart, then there are other (and better) mechanisms for dealing with that -namely, profiles.

If, on the other hand, you want to be notified just so you can see, out of interest and general amusement, which dumb user it is that can't remember their password 5 times in a row, then maybe someone else will have a trigger you can use, but in the meantime, as a busy DBA working in a busy office, you could probably just bear in mind the motto: "Si stultum requiris, circumspice".

Regards
HJR Received on Tue May 25 2004 - 19:10:50 CDT