Have you tried query from aud$ table, something like
select returncode, action#, userid, userhost, terminal from aud$ where returncode='1017'
==> ORA-1017 "invalid username/password; logon denied"
use this reference:
note 352389.1 Finding the source of failed login attempts.
it has some sample code for a trigger you can use, you can even let it hang in dbms_lock.sleep so you can check the client host for the application before it exits,
Harm ten Napel