topic Re: Security audit log in Application Development and Automation Discussions

Security audit log

Former Member — Tue, 27 Apr 2021 06:33:03 GMT

Hi,

While monitoring Security Audit Logs events in ArcSight, the events "Application server started (Event id AUG)" and "Application Server Stopped (Event id AUH)" occurred with no IP address or host name. How will find which application is started or stopped?

Re: Security audit log

tom_wan — Tue, 27 Apr 2021 07:31:26 GMT

I think you should contact ArcSight support for this, as it is a 3rd party product.

Regards

Tom

Re: Security audit log

cris_hansen — Tue, 27 Apr 2021 10:52:43 GMT

Hello,

SAL files should be recorded per application server. That means that the entry you see is from the application server itself.

Read more about SAL in this SAP Community blog.

Regards,

Cris

Re: Security audit log

JoeGoerlich — Tue, 27 Apr 2021 12:05:12 GMT

Hello anonymous user,

sadly many log files produced by SAP systems like SAP NetWeaver or SAP HANA do not have all necessary details inside the log files themselves, which would be the baseline for an easy SIEM integration. Here for example you need to enrich the logs with the hostname on which the logs have been generated.

We would love to see more alignment when it comes to logging - both between the components of the same product as well as between different products. Wondering how SAP ETD for example handles this, but my assumption is that SAP spent some effort in log enrichment, correlation, etc. instead of healing the root causes.

Regards

Joe Görlich

Re: Security audit log

Former Member — Tue, 27 Apr 2021 12:10:28 GMT

We have more than one application server. How we will find the application server without IP/host name?

For what purpose, the application server started and stopped?

Re: Security audit log

JoeGoerlich — Wed, 28 Apr 2021 11:20:52 GMT

On the SAP system you may configure the SAL log file name via profile parameter FN_AUDIT to include the hostname, the SID as well as the instance number. For example FN_AUDIT = audit_$(SAPSYSTEMNAME)_$(INSTANCE_NAME)_$(SAPLOCALHOST)_++++++++###### Then you may enrich the logs in your SIEM to include these values from the log file name during the import.

For this and for details like reasons for restarts of application servers please contact the responsible SAP administrators.

I also recommend to read the blogpost https://blogs.sap.com/2014/12/11/analysis-and-recommended-settings-of-the-security-audit-log-sm19-sm20/

Including SAP security monitoring into the SOC/CDC is a highly valuable step, but this means also to train the analysts to 'speek' SAP. No offence!

Best regards

Joe Görlich

Re: Security audit log

cris_hansen — Thu, 29 Apr 2021 17:47:38 GMT

I have just used SM20 in a test system with two app servers:

As you can see above, the Name displays the application server name (I cut the first part of the names). One ends with "73x" and the other one ends with "75".

So, you know what app server was stopped and started.

Why they are stopped and started: most likely a maintenance happened, that required a system (or instance) restart.

In my example, I didn't select a specific instance, so SM20 read the Security Audit Logs from both instances.

Regards,

Cris

Re: Security audit log

Former Member — Fri, 30 Apr 2021 04:04:22 GMT

Thank you for your reply,

We are analyzing security audit log in ArcSight SIEM. There are no field for application server's name.

The available details are attached here

application-server.png

Re: Security audit log

JoeGoerlich — Fri, 30 Apr 2021 07:56:12 GMT

How do you forward the SAL logs from the SAP NetWeaver AS ABAP to your SIEM?

Re: Security audit log

Former Member — Fri, 30 Apr 2021 08:55:00 GMT

Hi,

We have no idea about that and monitoring another organization's logs. we are new to the security audit log and monitoring another organization's logs.

There contains about 30+ servers for development, production and testing.

What is the difference between SAP ERP Central Component (ECC) and SAP NetWeaver AS ABAP ?