We changed a password on an Oracle schema, but apparently we have some rogue SDE clients - probably old ArcGIS map services on a dev machine somewhere - attempting to connect with the old password. SDE is causing Oracle to lock out the schema because of the rapidfire attempts to connect with the bad password.
Is there any way to detect where the bad login attempts are coming from? I have turned on the ArcSDE intercept log, but I don't see anything related to connect attempts there.
We're using SDE 9.3.1.