Hello. We have an Oracle DB account which every 5 minutes via the Linux Cron Job (same server where DB is running) accesses the DB and checks if the DB is accessible. Yesterday around 9:00 AM this account got locked which resulted in a ORA-28000 message. The account was unlocked and the monitoring operation proceeded as normal. The noted Database monitoring account is "ORACLE" and it accessed the DB via OS authentication ("sqlplus /" etc).
We've been trying to determine how the account could have gotten locked.
We've checked the dba_audit_session (and aud$) view and do not see the scenario where there were numerous failed login attempts generating ORA-1017 (Invalid Login/Password) type message causing the account to lock.