non-http stream match/catch

The issue is that there's not enough data present in the CLIENT_ACCEPTED event, which is triggered at the end of a successful TCP 3-way handshake. If you want to see TCP payload you have to collect (ie. buffer) that payload:

when CLIENT_ACCEPTED {
    TCP::collect
}
when CLIENT_DATA {
     Replace 'ORA-01403:' with 'ORA-01403:'
    STREAM::expression {@ORA-01403@ORA-01403@}
    STREAM::enable

    TCP::release
}
when STREAM_MATCHED {
    set hsl [HSL::open -proto UDP -pool HIGH_SPEED_LOGGING] HSL::send $hsl "DNA_STREAM,MATCH FOUND!"
}