oracle非法登录查询

select os_username, userhost, terminal, username, count(*)
  from dba_audit_trail
 where returncode = 1017
 group by os_username, userhost, username, terminal
having count(*) > 10