set lines 400
SET PAGES 3000
col OS_USERNAME for a20
col USERNAME for a20
col USERHOST for a20
col ACTION_NAME for a20
select OS_USERNAME
      ,ACTION_NAME
      ,decode (RETURN_CODE, '0', 'Successful logon',
               '1017', 'wrong combination user/password',
               '2004', 'Security violation',
               '28000', 'user locked',
               '28001', 'Password expired') STATUS
      , to_char(EVENT_TIMESTAMP,'MM-DD-YYYY HH24:MI:SS') 
from UNIFIED_AUDIT_TRAIL where OS_USERNAME like 'ora_ops'
order by EVENT_TIMESTAMP;