SAP Tracing tools

[Former Member]

Hello,

I have a request to implement a security solution for an ECC SAP system.

My system has a very sensitive data and for audit purposes I need to trace every users steps, date of logon, transactions, tables that were consulted. With the SAP Audit (SM19) I can have a lot of information, but as far as I know I can`t trace the tables that were consulted (not modified), so I am looking for some tool to accomplish this request.

I am evaluating the Oracle Audit right now, but I am looking for some SAP standard tool (similar to Oracle Audit). Does anyone knows if SAP has this kind of tool?

Someone tell me that SAP has some tracing tool for the SAPGUI, is it true?

Please feel free to advise.

Thanks in advance,

Regards,

Walde Requena

[Former Member]

Hello,

I have a request to implement a security solution for an ECC SAP system.

My system has a very sensitive data and for audit purposes I need to trace every users steps, date of logon, transactions, tables that were consulted. With the SAP Audit (SM19) I can have a lot of information, but as far as I know I can`t trace the tables that were consulted (not modified), so I am looking for some tool to accomplish this request.

I am evaluating the Oracle Audit right now, but I am looking for some SAP standard tool (similar to Oracle Audit). Does anyone knows if SAP has this kind of tool?

Someone tell me that SAP has some tracing tool for the SAPGUI, is it true?

Please feel free to advise.

Thanks in advance,

Regards,

Walde Requena

[Former Member]

Hi Walde,

For logging changes to SAP tables, you can have the change log activated thru' SE11 --> technical settings and view the logs via OY18 or SCU3. Also, activate profile parameter- REC/CLIENT.

If you want to trace even the tables displayed by user, ST05 sql trace might help.

Thanks

Sandipan

P.S: SAPGUI 720 do have some tracing tools but never used it so cannot comment on their effectiveness.

Message was edited by: Sandipan Choudhury

[Former Member]

Hi Sandipan,

In my case the ST05 will not be a good idea, I could use it to analyze some problems, but I need a permanent audit solution.

Thanks for your help.

Regards,

Walde Requena

[Former Member]

For very detailed logging would suggest KNOA tool. This is one of the SAP GUI tracing tool and can be deployed on a sensitive system. http://www.knoa.com/main/

[mvoros]

Hi,

I am struggling to understand how you want to use these client side tools for security. How can you trust client? It seems to me like a really bad idea. E.g. trusting client to escape all variables to prevent SQL injection. You would have to be able to lock users to PCs under your control. This is really hard and most of the time not feasible.

Cheers

[koehntopp]

Good points, it also limits you to entry points. If a user manages to access data from a different system all logging is gone.

As we haven't been given the exact nature of the data that needs monitoring we can only speculate, but usually I'd recommend locking down authorizations so that only clearly defined transactions can access the data at all - no SE16, SE38 or similar.

Then make these transactions available through the SAP GRC Firefighter - that seems to be exactly the purpose it was built for.

Plus, I'd be interested to see how the audit of the logs works. I often see companies gathering data like crazy, and once they try to use it they find that it's still the needle in the haystack. Can you clearly define the questions that you want to ask the logged data...?

Frank.

[Former Member]

Hi Varun,

I will take a look at KNOA tool, thank you

Regards,

Walde Requena

[Former Member]

Hello Martin / Frank

That’s what I was expecting for, a solution debate. I`m totally agree with you, a trace in the client side will not be a good idea, but I needed to check this solution, just because, someone here has sold this idea to  managers, anyway thanks for your answers, It  helped me to reinforce my concepts.

Frank, yes that’s right, we can have a lot of information with the audit tool in the system, but we need a good frontend to explore this information, that’s why I was thinking about Oracle Audit, What do you think about this tool? Respect to the GRC, yes we need it and I’ll take a look at the Firefighter as you said.

I’ll try to clarify my question, I need to have an audit solution that can be able to tell me when and who has access to some determined sensitive data (from where and how), of course with a good frontend. Are Oracle Audit and GRC a good security couple for this? Do you recommend any other tool?

I’m open to suggestions.

Best Regards,

Walde Requena

[mvoros]

Hi Walde,

regarding Oracle Audit. I don't know it but I assume that it can use some standard logging functions of Oracle DB. But this won't help you too much. DB is accessed by one SAP super user so you can't figure out which SAP account accessed DB.

The logic for logging  access to data needs to be built into app. SAP apps don't usually have logging features with your required level of detail. You can use approach suggested by Frank. You can lock all generic transactions such as SE16 and then control access to data by standard authorizations. E.g. you can control access to FI posting in FB03 based on company code.

Have a look at Splunk. I've heard only good things about it but from non SAP environment. It allows you to consume logs from multiple systems and it provides nice UI for working with logs. I wanted to play with it last week and I found that there is even app for Splunk. Somebody has already built a solution for SAP systems on top of Splunk. It seems to be more oriented to basis for system monitoring but it supports importing of SM19 log. I haven't had time yet to install it.

Cheers