you might also look at the Oracle Audit features.
You can audit for failed connections for example.
It would probably work better than a system level trigger.
You can even keep the log in the database.