prompt all attacks during the last 24 hours
select id,to_char(log_date,'DD-MM-YYYY HH24:MI') logdate, log_usr,terminal,err_nr,err_msg,stmt 
from system.oraerror
where log_date>sysdate -1;

prompt attacks per user
select log_usr,count(*) 
from system.oraerror
group by log_usr
order by 2 desc, 1;

prompt error per error message
select 'ORA-'||err_nr,count(*) 
from system.oraerror
group by 'ORA-'||err_nr
order by 2 desc, 1;


y 2 desc, 1;