How to Find log for Worng password attempt

[Former Member]

Hi friends,

This may not be the perfect forum for posting this question but I believe this wont b against any rules.

I am suffering from User locked due to Too Many Failed Attempts.

I just want to know is there any Tcode to find such log where i can find who exactly tried to log in the system with wrong attempts?

[Former Member]

Check Table USR02 Field LOCNT gives the no of incorrect login attempts

[Former Member]

Hi karan,

I've already tried USR02 but then it doesnt show from which machine the user has entered wrong password.

We could've found it from SM20 but then the AUDIT log is not activated on our Development server.

Is there any other way to find it ?

[Former Member]

Hi Yogesh,

refer this link you will get info on userid and password details

http://help.sap.com/saphelp_nw04s/helpdata/en/ee/10df3d0eb8af5ee10000000a114084/frameset.htm

Thanks and Regards,

Syf

[Former Member]

I am sorry my friend, that link is also not useful..

[Former Member]

Hi Yogesh,

Try running the report RSUSR200.

But lets say i put your user id and try to login and lock your user id, i don't think there is any way you can trace my user ID as i don't leave any trail in this case as i have never used my ID anywhere.

Any way we can wait for other replies

See if the report is useful to you

Regards

[Former Member]

Your suggestions are welcome..

[Former Member]

Yogesh Karanjikar ,

check the t code - SM19-security audit : display configuration of all instance.

and click the detail display button . hope this is u r need ..

if not revert me back .

thanks

chinnaiya

[Former Member]

Hi chinnaiya,

I tried it , the security audit is not activated on my DEVELOPMENT server.

I can trace the same on my QAC and PRD server through SM20.

[Former Member]

hi friend

go to SUIM t-code.

expand the user node

execute the with unsuccessful logons.

i hope it l solve .

regards

suren.s

[Former Member]

Hi Surender,

Thanks for your suggestion,

but SUIM doesn't give me the terminal from where the user tried to log into the system with wrong passwords...

[bolanos_raul]

Hi, with the Transaction SE91 you'll find the terminal if is this what you need.

[pboryczka]

Hi,

Go to SM21, you can find there list of systems messages, you need to find US1 - message ID (User USERNAME locked due to incorrect logon). You have to get details of log, and in Session details you can find Terminal.

Regards
PB