topic Re: Security Tracking report in Application Development and Automation Discussions

Security Tracking report

Former Member — Thu, 01 Mar 2007 21:43:45 GMT

Hi Folks

I would need some ideas with respect to the following

I would like to know changes made to the following

1. Organizational levels,

2. Changes to roles (by means of addition or deletion of tcodes)

3. Manual addition of objects to a role

4. Change of Auth Field values for an object.

I would like to have this information on a on-demand basis, In the sense I would like to have some kind of a report which I can query to have this information as and when required.

I am aware of the AGR tables however am not sure about the relationship one has with another.I have a feeling that one can pull out details from these tables... however dont exactly have a exact way to do it...

Could you please share your thoughts on how I can approach this.

best regards

Ravi

Re: Security Tracking report

Former Member — Thu, 01 Mar 2007 21:47:38 GMT

Ravi,

Have you run the change document reports in transaction SUIM? It provides for most of what you are looking.

Cheers,

Ben

Re: Security Tracking report

Former Member — Thu, 01 Mar 2007 21:55:47 GMT

Ravi,

Most of the change doc information is contained in tables such as CDHDR, USH* and objects such as CDCLS.

Cheers,

Ben

Re: Security Tracking report

Former Member — Sun, 04 Mar 2007 20:13:01 GMT

Hi Ben

I have tried the change documents, however for some reason have not found them very reliable. I would have a look at those tables and let you know.

thanks anywayz

Ravi

Re: Security Tracking report

Former Member — Mon, 05 Mar 2007 07:35:50 GMT

Hi Ravi,

You can actually access change Documents in SUIM to extract a report on the changes made to Role, Filed Values, etc...

But if you want to extract a report using tables, you can go for AGR* tables such as:

AGR_1251 Authorization data for the activity group

AGR_1252 Organizational elements for authorizations

AGR_AGRS Roles in composite role

AGR_TCODES Assignment of roles to Tcodes

AGR_USERS Assignment of roles to users

You can also write a Infoset Queries using SQ01, SQ02, SQ03 which would help you in getting a report from more than 1 Table at once.

Thanks & Regards,

Santosh

Re: Security Tracking report

Former Member — Mon, 05 Mar 2007 19:22:11 GMT

HI Geek,

Whatever you want to do investigation or any query go to transaction SQVI and select AGR tables and join them and run the query as you want. You can run whatever report you want. You can every solution in ths SQVI. Check it and don't forget to this to vote me

Re: Security Tracking report

Former Member — Mon, 05 Mar 2007 21:48:01 GMT

We are not on Netweaver yet, but I doubt this has changed...One caution, if you use SQVI or SQ01/SQ02 to join tables, you can't join AGR_USERS and PA0105 on userid because they use different field names & sizes. We got around it by having our ABAP group give us a custom table view...because they can choose to ignore the warning that it gives them. Only takes a few minutes for them to do and it gave us a whole new range of queries we could do.