topic Replication or remote RAL logs in Application Development and Automation Discussions

Replication or remote RAL logs

Former Member — Fri, 23 May 2014 05:49:11 GMT

Hello experts,

We are switching from Seclog to RAL (after an upgrade).

In this context our customer has asked us if it is possible to replicate the RAL logs to a remote site, so a internal hacker isn't able to clear his tracks by deleting RAL logs from fx. OS level.

They want us to replicate to a customer secure site.

Is this supported directly in RAL or do we have to make a manual DB replication of relevant tables?

Cheers,

Kenneth

Re: Replication or remote RAL logs

Former Member — Mon, 26 May 2014 09:17:17 GMT

Hi Kenneth,

actually you have more than one option, you can use the archiving function to move the data out of the system after some time (I'd guess however, this is not what you meant).

In addition you can also use the replication function to retrieve the read-access log from an another system and import it into a central monitoring system. Depending on you ruse case, this might be not enough, as you usually would then use a batch process to just replicate on a regular basis.

In addition to the replication, there is also a monitoring API, which you can use. You can find the documentation of the API in the system. This would allow you to directly send the info to arbitrary destiations, however you will have to code this yourself.

Kind regards,

Patrick

Re: Replication or remote RAL logs

Former Member — Wed, 28 May 2014 09:03:28 GMT

Thanks Patrick, i will look into those functions.

Re: Replication or remote RAL logs

Former Member — Wed, 28 May 2014 10:39:41 GMT

Hello again, i am just reading about the archiving part.

Her it says:

************************

.....

Deleting Data from the Archive

Data that has been saved to an archive can be deleted from the database.

Start Archiving Administration ..............

************************

I am a little bit confused, the heading says that you can delete archived data, but in line two it sounds more like you can delete data from the real database, when it has been archived..?

I am not sure i would like an archiving system of security logs, where data can be deleted after being archived.

Am i misreading it?

/Kenneth

Re: Replication or remote RAL logs

Former Member — Wed, 28 May 2014 11:20:34 GMT

HI Kenneth,

Data archiving is explained in more detail in the docs, in short, you can do both, first write the data to an archive and delete then or just delete without writing.

Regards,

Patrick

Re: Replication or remote RAL logs

Ulli_Hoffmann — Fri, 15 May 2015 16:06:29 GMT

Hello Patrick,

could you give me a hint where the monitoring API+documentation is included (package or class etc.)?

Thanks,

Ulli

Re: Replication or remote RAL logs

Former Member — Mon, 18 May 2015 10:52:23 GMT

Hi Ulli,

please search for the interface IF_SRAL_MONITOR

The factory class is named CL_SRAL_READER_FACTORY

Kind regards,

Patrick

Re: Replication or remote RAL logs

Ulli_Hoffmann — Mon, 18 May 2015 15:32:57 GMT

got it! Thx, Ulli

Re: Replication or remote RAL logs

Erol_CAGLAR — Thu, 10 Sep 2015 11:37:58 GMT

You can run SRAL_REPLICATION program under the se38 or sa38 transaction.