Number of failed login attempts exceeds threshold value.

Hi Experts,

I am getting this OEM 13c alert "Number of failed login attempts exceeds threshold value." from Failed login count metric for only one of the database.

When I go to the database and run the below query I found so many failed logins attempts by sysman user just for a day.

select username,os_username,RETURNCODE,userhost,trunc(timestamp),count(*) failed_logins from dba_audit_trail where returncode<>

   0 and timestamp>trunc(sysdate) group by username,os_username,RETURNCODE,userhost,trunc(timestamp) order by 5;

USERNAME             OS_USERNAME          RETURNCODE      USERHOST                             TRUNC(TIMESTAMP)               FAILED_LOGINS
-------------------- -------------------- ---------- -------------------- ------------------------------ -------------