How to find failed login attempts??

Enable auditing for failed login attempts
-- # 1 - Modifiy initialization parameters
alter system set audit_trail=db scope=spfile;
-- # 2 - Restart the database 
shutdown immediate
startup
-- # 3 - Enable auditing for failed login attempts
audit create session whenever not successful;
-- # 4 - Query the dba_audit_trail view to see failed login attempts 
select OS_USERNAME,USERNAME,USERHOST,to_char(timestamp,'MM-DD-YYYY HH24:MI:SS'), returncode
from dba_audit_trail 
where returncode > 0