USER_AUDIT_SESSION contains audit trail records concerning connections and disconnections of the current user.
Select os_username, username,userhost,terminal,timestamp,action_name,logoff_time,RETURNCODE
from DBA_AUDIT_SESSION where RETURNCODE in (1017,28000) order by timestamp.
look for the row just before reurncode 28000 and you will get when,which os user from which terminal the account got unlocked.
Column Datatype NULL Description
OS_USERNAME VARCHAR2(255) Operating system login username of the user whose actions were audited
USERNAME VARCHAR2(30) Name (not ID number) of the user whose actions were audited
USERHOST VARCHAR2(128) Client host machine name
TERMINAL VARCHAR2(255) Identifier of the user's terminal
TIMESTAMP DATE Date and time of the creation of the audit trail entry (date and time of user login for entries created by AUDIT SESSION) in the local database session time zone
ACTION_NAME VARCHAR2(28) Name of the action type corresponding to the numeric code in the ACTION column in DBA_AUDIT_TRAIL
LOGOFF_TIME DATE Date and time of user log off
LOGOFF_LREAD NUMBER Logical reads for the session
LOGOFF_PREAD NUMBER Physical reads for the session
LOGOFF_LWRITE NUMBER Logical writes for the session
LOGOFF_DLOCK VARCHAR2(40) Deadlocks detected during the session
SESSIONID NUMBER NOT NULL Numeric ID for each Oracle session
RETURNCODE NUMBER NOT NULL Oracle error code generated by the action.
Some useful values:
0 - Action succeeded
2004 - Security violation
28000 - user locked
1017 -wrong combination user/pasword
CLIENT_ID VARCHAR2(64) Client identifier in each Oracle session
SESSION_CPU NUMBER Amount of CPU time used by each Oracle session
EXTENDED_TIMESTAMP TIMESTAMP(6) WITH TIME ZONE Timestamp of the creation of the audit trail entry (timestamp of user login for entries created by AUDIT SESSION) in UTC (Coordinated Universal Time) time zone
PROXY_SESSIONID NUMBER Proxy session serial number, if an enterprise user has logged in through the proxy mechanism
GLOBAL_UID VARCHAR2(32) Global user identifier for the user, if the user has logged in as an enterprise user
INSTANCE_NUMBER NUMBER Instance number as specified by the INSTANCE_NUMBER initialization parameter
OS_PROCESS VARCHAR2(16) Operating System process identifier of the Oracle process