How to find failed connection attempts using listener log?

[oracle@dbhost01 trace]$ awk  '{ if ( $NF != 0 ) print $0 }' listener_scan1.log|head

11-MAR-2020 10:39:20 * (CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=sqlplus.exe)(HOST=apphost01)(USER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=host1)(PORT=39371)) * establish * ORCL * 12505
TNS-12505: TNS:listener does not currently know of SID given in connect descriptor
11-MAR-2020 10:39:20 * (CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=sqlplus.exe)(HOST=apphost01)(USER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=host1)(PORT=43478)) * establish * ORCL * 12505
TNS-12505: TNS:listener does not currently know of SID given in connect descriptor
11-MAR-2020 10:39:20 * (CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=sqlplus.exe)(HOST=apphost01)(USER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=host1)(PORT=39377)) * establish * ORCL * 12505
TNS-12505: TNS:listener does not currently know of SID given in connect descriptor
11-MAR-2020 10:39:20 * (CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=sqlplus.exe)(HOST=apphost01)(USER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=host1)(PORT=43484)) * establish * ORCL * 12505
TNS-12505: TNS:listener does not currently know of SID given in connect descriptor
11-MAR-2020 10:39:30 * (CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=sqlplus.exe)(HOST=apphost01)(USER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=host1)(PORT=50217)) * establish * ORCL * 12505
[oracle@dbhost01 trace]$

Command for counting the ORA- errors in alert log file.

    As a DBA, one of the primary responsibility is morning the alert log and identifying the issues and fixing them. Some times we may need no of ORA errors and each error count. Using below mentioned command we can get the required output easily. Hope this helps someone.

/home/oracle$  grep -oh "\w*ORA-\w*" alert_ORCL.log |sort|uniq -c
      1 ORA-00028
    132 ORA-00060
      5 ORA-00202
      4 ORA-00206
      1 ORA-00221
      5 ORA-00235
      5 ORA-00245
      3 ORA-00272
/home/oracle$