WebLogic Auditing Provider Not Logging the <USERLOCKED> Event (Doc ID 2699117.1)

Last updated on OCTOBER 17, 2023

Applies to:

Symptoms

<USERLOCKED> Audit Event is not getting logged in the Audit logs .

Steps followed:

1) Login to console--security realms---my realm-- Providers -- Auditing --Create new Auditing provider
2) Click on the new Auditing provider ---configuration---Provider Specific---this page has options to configure auditing log rotation / severity
3) After this configuration restart the WebLogic admin server and try to login to the console with wrong password .

By default 5 consecutive invalid login attempts will lock the user after which you should see the below message in the Audit logs:

Changes

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.