I need a script to read all the failed log in users as part of auditing. We are using oracle 11g. There are thousands of files with .aud extension from which I have to segregate the unsuccessful ones. I queried sys.aud$ where I got the column names like entryid, sessionid, linux node, time etc., but I cannot find from where the above log files are being created. Any help in this regard will be highly appreciated.

Thanks