oracle非法登录查询

[sql] 

select os_username, userhost, terminal, username, count(*)  

  from dba_audit_trail  

 where returncode = 1017  

 group by os_username, userhost, username, terminal  

having count(*) > 10