Creating and Managing DatabaseHits at your project level for Audit Logs in Cloud HANA

[farihakazi]

In SAP HANA CockPit

Search for the Auditing Service                                                       

Creating the new "DatabaseHits" Audit Policy

1. 1. Navigate to Audit Policies: Within the "Auditing" section, select "Audit Policies."
   2. Create New Policy:

Click "Create" to start defining a new audit policy. 

            

• Policy Name: Enter DatabaseHits.
• Description: Provide a meaningful description, such as "Audit policy to track database hits and accesses for my project."

 Define Audit Conditions:

• Actions: SELECT, INSERT, UPDATE, DELETE.
• Object Type: TABLE.
• Object Name: Specify specific tables/objects.                                                   

Configure Audit Trails:

• Define the retention period for audit logs.     
            

Select the relevant schema after checking in DB explorer

Activate Policy:

• Save the new audit policy.
• Ensure the policy status is "Active.

When you execute a query in DB explorer you can view the logs:

To integrate this logs in your Project - Create User and Role:

CREATE USER ISUSUSER PASSWORD "Welcome1234" SET USERGROUP DEFAULT;

ALTER USER ISUSUSER DISABLE PASSWORD LIFETIME;

CREATE ROLE DBROLE;

GRANT SELECT, EXECUTE, SELECT METADATA ON SCHEMA "DBADMIN" TO DBROLE WITH GRANT OPTION;

GRANT DBROLE TO ISUSUSER WITH ADMIN OPTION;

Bind the Service: Use the Cloud Foundry CLI to create a user-provided service:

cf cups DBCS_ACCESS -p "{\"user\":\"ISUSUSER\",\"password\":\"Welcome1234\",\"tags\":[\"hana\"],\"schema\":\"DBADMIN\"}"

Addition of grants file in project db/cfg path

{

    "DBCS_ACCESS": {

      "object_owner" : {

        "roles" : ["DBROLE" ]

      },

      "application_user" : {

        "roles" : ["DBROLE" ]

      }

    }

  }

Addition of hdbsynonym file(audit_log.hdbsynonym) at db/src to expose the audit log table held in the Admin schema

{

  "APP_INTERACTIONS_AUDIT_LOG": {

    "target": {

      "object": "AUDIT_LOG",

      "schema": "SYS"

    }

  }

}

Addition of the Audit_Log entity in .cds file with the annotation persistence.exists. Please refer to the screenshot below :

Finally exposing the entity as an ODATA service in the service catalog file interactions-srv.cds

Now this entity can be used in your UI application to view specific logs about your particular project.

For e.g we created a Auditlog tile and used the oData :