I suspect ordinary users know the production password from a user with DBA privilege, bad application design I know but it is historical before I arrived on site.

Therefore what is the best way I can identify who is logging in as this user! machine name e.g obviously v$session but I want to know if anyone has implemented anything similar. I can of course change the password but I want to catch the sneaky buggers red handed!

Thanks in advance..