SELECT USERNAME, OS_USERNAME, USERHOST, action_name,
       decode(RETURNCODE,0,'Logon Accepted',1017,'Failed - Invalid username/password',28000,'Failed - the account is locked',28001,'Failed - the password has expired',RETURNCODE) RETURNCODE,
       to_char(TIMESTAMP,'DD-MON-YYYY HH24:MI:SS') TIMESTAMP
FROM SYS.DBA_AUDIT_SESSION
order by timestamp desc