How to check who lock an Account?
-- AM prints out AM or PM
-- returncode
-- 0: indicates success
-- 1017: "invalid username/password; logon denied."
-- 28000: indicates account is locked out
SELECT os_username, username, userhost, action_name, to_char(extended_timestamp,'yyy/mm/dd hh24:mi:ss AM') login_time
FROM dba_audit_session where username='user_name' and returncode=1017
ORDER by 1;