topic Re: Audit trail in Application Development and Automation Discussions

Audit trail

Former Member — Mon, 04 Feb 2008 08:21:08 GMT

Dear all,

Please kindly help me since im still a new comer in SAP.^_*

Currently, im trying to test whether my SAP audit log is enable.

I have check that the rsau/enable value is 1, hence my audit log is already enable right?

Then i performed a testing, i access Tcode VD01 on 04.02.2008 at apprx. 13:00, when i execute Tcode SM20, those activity is not being tracked (the result is blank).

In Tcode SM21, there is activity round those time however Tcode column is blank and the user ID is SAPSYS (which is not my user ID).

Is there some setting that i have not set yet?

Many thanks

Re: Audit trail

Former Member — Mon, 04 Feb 2008 09:02:28 GMT

Hi Yuli,

This help document might be helpful in configuring the audit.

http://help.sap.com/saphelp_nw04/helpdata/en/68/c9d8375bc4e312e10000009b38f8cf/frameset.htm

-Pinkle

Re: Audit trail

Former Member — Mon, 04 Feb 2008 09:07:27 GMT

Thanks Pinkie,

I have applied all of these filters but the audit log still has not records anything

Cheers,

Re: Audit trail

Former Member — Mon, 04 Feb 2008 22:16:45 GMT

Yuli,

Could you verify the following:

1. Did you activate Security Audit thru SM19? (I did not see you mentioned that in your post)

2. For SM20 & SM21, did you select all Apps Servers when you read the logs?

Thanks,

Lye

Re: Audit trail

Former Member — Mon, 04 Feb 2008 22:38:20 GMT

Hi Yuli,

In Filter, have you selected All in the Event?

Also go to the "detail configuration" and select recording for "Transaction start" & "Report start" audit class.

-Pinkle

Re: Audit trail

Former Member — Tue, 05 Feb 2008 05:59:42 GMT

Dear Lye,

i have tick the filter 1 and filter 2 in SM19 i.e. related to transaction start and report start.

And i have activate the icon of fire matchs in toolbar?

is this action means i have activate the audit log?

moreover, what is the different filter 1 and filter 2?

Thanks

Re: Audit trail

Former Member — Tue, 05 Feb 2008 09:15:04 GMT

Yes, you would need to activate the "profile" and restart the instance before it takes affect, in addition to activate the rsau/enable and defining the filters themselves.

Per default, you have 2 "slots" for static filters. I would recommend first changing the system parameter rsau/selection_slots to your desired number of "slots", before you set and activate the filters... otherwise you need to reset and reactivate them again, and restart the instance again.

You will anyway need to do this twice.

Cheers,

Julius

Edited by: Julius Bussche on Feb 5, 2008 9:40 PM

Mix up between (defined/active) profiles and available slots corrected.

Re: Audit trail

Former Member — Tue, 05 Feb 2008 18:27:04 GMT

Yuli,

Make sure the "Filter Active" checkbox is check. If both Filter 1 & 2 "Filter Active" is not check, it should give you a message when you activate the Audit. This is an option to let you decide which filter you want to be active. This is the common error if you are not familiar with SM19.

By the way, once the Audit is activated, under the DynamicConfig tab, you should see the "Current File Size" increase, telling you the system is capturing some audit data.

Filter 1 & 2 are the same, just giving you more options. For example, you can have filter 1 for client 100, all audit classes, and Filter 2 for client 110 for dialog login only. Like Julius said, by default you get two filters, you can change it from 1 to 5.

Good luck.

Lye

Re: Audit trail

Former Member — Tue, 05 Feb 2008 18:32:36 GMT

Julius,

Have a system profile question for you. My rsau/enable parameter is set to 0 (audit not activated), I still can activate my Audit Profiles and getting Security Audit data. Did I missed something?

Thanks,

Lye

Re: Audit trail

Former Member — Tue, 05 Feb 2008 21:38:33 GMT

Hello Lye,

There are 2 typical causes I can think of:

- you set rsau/enable back to 0, but did not restart the instance.

- your dynamic filters are still active and set.

Cheers,

Julius