ArcSDE supports tracing (SDETRACE variable), but that's a client library command
logging capability (only mentioned due to probability of free text search hits).
To track down a rogue application server client, you should just need to look in the
application server's logs. A rogue Direct Connect client would log to it's own SDEHOME,
so you'd need to search for all clients (which is a tad harder), but Oracle should be able
to log these connection failures, so the Oracle logs might give more infomation
- V