Checking User activity log for a Specific period

[Former Member]

I am interesting in getting a list of Posting transactions accessed by users for a 12hour period every day for 1 whole year.

Is there a transaction that will allow this other than SM20,or a table i'll need to look at.

SM20 seems sort of limited if you need to produce this report for the 365 days within the year.

Suggestions/advice welcomed.

Thanks

Adeel

[Former Member]

ST03(n) /STAD will fetch you the user activities.

It depends on the retention period which is set for these tcodes I am afraid wthr 1 year old data can be pulled out using these monitoring tcodes.

Rakesh

[Former Member]

I donu2019t this it's possible for 1 year ,if you are backing up of STAD report every day or weekly or monthly the you can get it ,weekly we downloading stat report

ST03n current month and last month only possible

From STAT you can get more then one month depend on your memory if you are running more you own get the data it will go to DUMP

If you want user wise you can run the report STATDUMP

[Former Member]

Hi

check SAP Note 139418 - Logging user actions,

Ravi

[morten_nielsen]

Hi Adeel

I think I would try a different approach

If you, by "Posting transactions", mean Transactions that has created a financial document (FI Document), then I would simply take a look at table BKPF directly. In this table you can find Date, time, transaction and username for all FI Document.

I guess you will be able to find this kind of information for other document types as well, by looking at the header tables (EKKO for Purchase orders, VBAK for Sales orders etc.)

And remember, just looking at which postings transaction-codes are used, won't give you the whole story. SAP data can be changed in lot of different way's and not just through the standard posting transactions: (e.g. BSP/Webdynpro applications, through the debugger, through other report etc...).

If you want to get the through story you need to activate table logging for the tables in question. If that's done, you can monitor the changes in SCU3. (but be careful there could be some performance issues here )

Regards

Morten Nielsen

[Former Member]

I was thinking the same thing, but suspected that the reason behind this is to audit who is working (and possibly posting) during strange hours of the night or weekends.

However the problem with this is batch job processing often run overnight, and for global systems with users in multiple time zones this becomes more tricky as well.

You also wouldn't find data downloads or be able to audit a pattern in the behaviour of the user. From my experiences, it is a pattern in the behaviour of the ID which leads to events which are worth taking a closer look into.

Particularly the stupid ones always make the same mistake at least twice

Cheers,

Julius