SQL> show parameter audit_trail;

SQL> audit session;

SQL> select os_username, userhost, username, action_name, timestamp, returncode
2 from dba_audit_trail
3 where returncode=1017;