Record the client IP (Extended access.log) and the failed user ID (Auditing provider) for OBIEE 11g and 12c logins, and match the two by time, with real log examples.
Tracking Failed OBIEE Logins: Client IP and User ID in WebLogic Logs Read Post »
Add the WebLogic Auditing provider, set severity and log location, turn on configuration auditing, and extract BEA-1599xx audit messages, checked against WebLogic 12.2.1.4 and 14.1.2 docs.
WebLogic Auditing: Track Changes with an Auditing Provider and Configuration Auditing Read Post »
Where boot.properties goes, a safe creation script, how to confirm encryption, Node Manager differences, and fixing BEA-090402 after a password change, checked against WebLogic 12.2.1.4 and 14.1.2 docs.
WebLogic boot.properties: Start Servers Without the Password Prompt Read Post »