How to find failed connection attempts using listener log?

[oracle@dbhost01 trace]$ awk  '{ if ( $NF != 0 ) print $0 }' listener_scan1.log|head

11-MAR-2020 10:39:20 * (CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=sqlplus.exe)(HOST=apphost01)(USER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=host1)(PORT=39371)) * establish * ORCL * 12505
TNS-12505: TNS:listener does not currently know of SID given in connect descriptor
11-MAR-2020 10:39:20 * (CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=sqlplus.exe)(HOST=apphost01)(USER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=host1)(PORT=43478)) * establish * ORCL * 12505
TNS-12505: TNS:listener does not currently know of SID given in connect descriptor
11-MAR-2020 10:39:20 * (CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=sqlplus.exe)(HOST=apphost01)(USER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=host1)(PORT=39377)) * establish * ORCL * 12505
TNS-12505: TNS:listener does not currently know of SID given in connect descriptor
11-MAR-2020 10:39:20 * (CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=sqlplus.exe)(HOST=apphost01)(USER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=host1)(PORT=43484)) * establish * ORCL * 12505
TNS-12505: TNS:listener does not currently know of SID given in connect descriptor
11-MAR-2020 10:39:30 * (CONNECT_DATA=(SID=ORCL)(CID=(PROGRAM=sqlplus.exe)(HOST=apphost01)(USER=oracle))) * (ADDRESS=(PROTOCOL=tcp)(HOST=host1)(PORT=50217)) * establish * ORCL * 12505
[oracle@dbhost01 trace]$