audit_file_dest                      string                           C:\ORACLE\ORA12C\HOME\DBS\ADMIN\ADUMP
audit_sys_operations                 boolean                          TRUE
audit_trail                          string                           DB

select
    os_username,
   username,
   userhost,terminal client,
   action_name,
   returncode,timestamp
from
      dba_audit_session
      where
      returncode='1017'
      and
      username=='<username>'
      order by timestamp desc

select terminal,userhost,spare1,ntimestamp# from aud$
where
returncode='1017'
and
userid='<username>'
order by ntimestamp# desc