Try this:

CREATE TABLE connection_audit (
login_date DATE,
user_name VARCHAR2(30));


CREATE OR REPLACE TRIGGER logon_failures
AFTER SERVERERROR
ON DATABASE

BEGIN
IF (IS_SERVERERROR(1017)) THEN
INSERT INTO connection_audit
(login_date, user_name)
VALUES
(SYSDATE, 'ORA-1017');
END IF;
END logon_failures;
/

Login in with bad password or invalid user names several times and and
test different scenarios.

SELECT * FROM connection_audit;

/*
other errors that could be trapped include:
ORA-01004 - default username feature not supported
ORA-01005 - null password given
ORA-01035 - Oracle only available to users with restricted session priv
ORA-01045 - create session privilege not granted
*/