How to find/audit Failed Login Attempts in OID 11g
It is often required (for audit compliance or for troubleshooting) to record failed or successful login attempts for Oracle Internet Directory (LDAP Server from Oracle).
There are multiple ways (WLST, EM, LDIF, ODSM) to enable auditing in Oracle Internet Directory (OID)11g to record failed or successful logins and most simple way is to enable it via Enterprise Manager (/em) Console ( EM is an application deployed on weblogic and integrated with OID automatically during configuration or later using opmnctl registerinstance )
Failed or Successful login attempts to OID will be recorded in $ORACLE_INSTANCE/auditlogs/OID/[oid1]/audit-pid[*****].log (Note : login attempts are recorded in auditlogs and NOT diagnostics)
You will see output like “2012-08-12 19:20:51.914958 “OID” “004lvTcRpnnBx00_NxXBie0002vl0001Sn,0” – – “8089” – – “UserLogin” FALSE – “cn=Atul,cn=Users,dc=onlineappsdba,dc=com” “Operation name: bind” “49” “192.168.1.12” – – – – “bind” “Simple:DN/Password Based“” ( Error code 49 means invalid credentials )
References