Skip to Main Content
  • Questions

  • Warning Event: <hostname.domain name>: <db name> DB - Failed logon attempts

Breadcrumb

Connor and Chris will both be at AI World from October 12 to October 17 , the premier Oracle conference of 2025. If you're in Vegas, please come say Hi or pop into our sessions

Question and Answer

Connor McDonald

Thanks for the question, Shravan.

Asked: November 04, 2017 - 2:25 pm UTC

Last updated: November 06, 2017 - 1:53 am UTC

Version: 12.1.0.2

Viewed 1000+ times

You Asked

OS_USER HOST_NAME TERMINAL USERID Login Date CLIENT_PROGRAM_NAME Error massage
oracle hostname.domain name SYSTEM 11-02-2017 14:54:05 sqlplus@hostname.domain name (TNS V1-V3) ORA-1017:invalid username/password; logon denied

[oracle@<hostname> ~]$ crontab -l
#Incremental backup TRITONS database
#0 4 * * * /home/oracle/cronjobs/rman_incr_backup.sh
#Backup archieve logs TRITONS database by every six hours
#0 */6 * * * /home/oracle/cronjobs/archivelog_backup.sh
#Clear all archive logs of TritonS DB by every four hours
#0 */4 * * * /home/oracle/cronjobs/archivelog_clear.sh
#BackUp Usage Statistic
#0 8 * * * /home/oracle/scripts/mgt_dump/stat_usage_dump.sh
[oracle@<hostname> ~]$

As you can see..all my cron jobs are commented out

Any ideas? This error occurs every day at the same time

and Connor said...

Well...*something* is trying to logon :-)

Since it happens at the same time every day, I'd be looking at the scheduler. Remember that scheduler jobs can be *external* programs (such as SQL Plus).

Even dbms_job could be used to fire off a Java proc when then calls out to SQL Plus.

And if you have any trusted authentication, then that request could be coming from *anywhere* in your network, eg "host1" does:

ssh oracle@hostname "sqlplus system...."

Hope this helps.

Is this answer out of date? If it is, please let us know via a Comment
more

Connor and Chris don't just spend all day on AskTOM. You can also catch regular content via Connor's blog and Chris's blog. Or if video is more your thing, check out Connor's channel and Chris's channel from their Youtube channels. And of course, keep up to date with AskTOM via the official twitter account.

More to Explore

Security

All of the vital components for a secure database are covered in the Security guide.