Track whether user has downloaded a table using SE16n

[daphneo]

Is it possible to pick up whether users have downloaded table data using SE16n?

We can pick up downloads that were done with SE16, but not via SE16n. And way we can pick that up?

Note that using SM20 you can pick up which table was viewed in SE16n and when a download took place, but if a user is using multiple SE16n sessions to view different tables, you will not know which table/session has been downloaded. So looking for something other than standard SM20.

[daphneo]

Is it possible to pick up whether users have downloaded table data using SE16n?

We can pick up downloads that were done with SE16, but not via SE16n. And way we can pick that up?

Note that using SM20 you can pick up which table was viewed in SE16n and when a download took place, but if a user is using multiple SE16n sessions to view different tables, you will not know which table/session has been downloaded. So looking for something other than standard SM20.

[TammyPowlas]

Hello Daphne - we can see it in our system with program RSAU_READ_LOG - please see Frank B's great blog on the topic here: https://blogs.sap.com/2014/12/11/analysis-and-recommended-settings-of-the-security-audit-log-sm19-sm...

Selection screen:

Filter by AUY Message ID

[daphneo]

Thank you very much. I also had a look at RSAU_READ_LOG earlier, but it does not seem to show the table that was downloaded accurately.

Take for example the screenshot below. The last line is the table download. But I had 2x SE16n sessions open and downloaded 1 table. Looking at this data, can you tell accurately which table was downloaded? I know it is USR02, but looking at the data alone it is not possible to tell. Or is it?

[TammyPowlas]

Hi Daphne - looking at my system, it would likely be the last table shown in SE16N.

[daphneo]

Hi tammy.powlas3. You are correct that it is "most likely" the last table. But we can't say for sure. My last screenshot above was done as to show a case where it is not necessarily the last table. In that case it was the second last table. So it's possible to 'cheat' the logic. We are really looking for a way in which we can say for certain which table it was.