Enterprise Portal user trace

Hi,

We are having issues with one of our portal user. UserID is getting locked with the failed logon attempts(can see from 'account info' under user admin) and this is happening every one hour.

Looked at the default trace logs but nothing is captured. Is there anyway that we can perform a trace for the specific user and see from where it is attempting to perform logon?

I used Diagtool in the past but this is happening in the prod system dont think that will be an option as i have to deploy the sca package.

We are on NW 7.31 version.

Any suggestion would be helpful.

Thanks,