TA_failed_login

SELECT OS_USERNAME, USERNAME, USERHOST, TO_CHAR(EXTENDED_TIMESTAMP, 'DD-MON-YYYY HH24:MI:SS') AS TIMESTAMP, ACTION_NAME, RETURNCODE
FROM DBA_AUDIT_SESSION
WHERE RETURNCODE IN (1017, 28000)
-- 1017: invalid username/password, 28000: account locked
AND EXTENDED_TIMESTAMP > SYSTIMESTAMP - INTERVAL '1' MINUTE ORDER BY EXTENDED_TIMESTAMP DESC;