Security audit log stopped recording transaction starts after upgrade

[jurjen_heeck]

All,

I am a bit lost around RSAU_CONFIG settings. At one customer site, since the upgrade from ECC to HANA (Current version 754) the security audit log stopped logging (a.o.) transaction starts despite the fact that nothing was changed in the log configuration. After the latest application server restart I can only see client setting changes in the log but nothing else.

Can someone here please point me in the right direction?

Thanks!

Jurjen

[cris_hansen · Accepted solution]

Hi Jurjen,

You can read SAP Note 2191612 (the SAL FAQ).

Another recommendation is this SAP Community blog on SAL, written by one of our developers.

If you still face issues, then share the SAP_BASIS SP level and the kernel patch level (since SAP_BASIS is 7.54, I assume the kernel is 777).

Regards,

Cris

[jurjen_heeck · Accepted solution]

Looks like I've got some reading to do, thank you for both the blog and the note. Firing up my ABAP Developer edition right now!

[huberda]

Hi,

please check the following kernel-patch of AU3/AU4 event - we also noticed this change.

I would assume, that normal SAL logging is working, only tcode starts are affected right?

2949892 - Inconsistent transaction field in AU3/AU4 entries in the security audit log

Symptom

With a recent version of note 2191612 colleagues have specified how the field "transaction" in security audit log entries is to be interpreted.

Some entries written for the start of a transaction were not consistent with this definition. The correction delivered with this note makes sure that the transaction field is set correctly for all log entries of type AU3/AU4 written by the SAP kernel.