How to trace the origin of a failed RFC logon

Hi,

Recently, in our security audit log, it is found that an ID is locked because of invalid password and the logon request is issued from RFC/CPIC call. I would like to know what I can check to know where (IP / hostname) is this RFC/CPIC call comes from. Anyone can help ?

thanks,

Diana