shaheerxt

-- On the database, enable auditing:
ALTER SYSTEM ALTER CONFIGURATION ('nameserver.ini', 'SYSTEM')
set (
        'auditing configuration',
        'global_auditing_state'
    ) = 'true' with reconfigure;
-- All audit logs should be directed to a database table called audit log in our scenario:
ALTER SYSTEM ALTER CONFIGURATION ('nameserver.ini', 'SYSTEM')
set (
        'auditing configuration',

shaheerxt

-- Please enable the auditing on database as documented in https://gist.github.com/shaheerxt/2ceda6c2d49e1fd33187428ff9da5a0b
-- Setup Policy as SYSTEM user (On the database - SYSTEMDB or TENANT DB):
CREATE AUDIT POLICY "AUDIT-USER_CONNECT_FAILURES" AUDITING UNSUCCESSFUL CONNECT LEVEL INFO;
-- Query to check if there are failures:
select *
from audit_log
where audit_policy_name = 'AUDIT-USER_CONNECT_FAILURES'
order by timestamp desc
limit 100;
-- You may want to check minutes aggregation if you have an application that often makes unsuccessful connections the database.