The Failed Login Attempts alert notifies you when its configured condition is met on Oracle instances so you can investigate and respond.
This alert counts failed Oracle login attempts. Repeated failures can indicate expired or incorrect application credentials, a misconfigured client, or an attempted brute-force attack. Mini DBA evaluates the condition once a minute, and the configured duration prevents an isolated typing mistake from immediately becoming an incident.
This alert makes repeated authentication failures visible so you can correct broken application credentials or investigate suspicious access before accounts are locked or the failures become a security incident.
Enable it on production, shared, regulated, and externally reachable environments. You can use lower severity in isolated development systems, but keeping the signal visible helps catch account and permission drift early.
The default minor threshold is 5 failed attempts and the major threshold is 10. Raise these values only when a known authentication process legitimately retries several times. Use lower thresholds for privileged accounts, externally reachable systems, or environments with stricter security monitoring.
Review Oracle audit and listener logs to identify the account, client, and source host. Correct invalid application credentials, unlock accounts only after confirming the cause, and investigate or block suspicious attempts according to your security policy.
Allow for an occasional mistyped password, but do not hide repeated failures from the same account or source. Use duration and severity to separate isolated mistakes from persistent application failures or suspicious access.