Unable to View Audit Log entries in SAP XS Advanced Cockpit

[former_member687142]

Hi,

I have enabled AuditLog in SAP XS Cockpit (System Overview -> Security area -> enable Auditing tile). Also created the audit policy successfuly.

In SAP HANA XS Advanced created audit log instance and connected with the desired app.
Now i'm trying to read the entries of audit log but they do not appear in SAP HANA Studio (using sql console) nor in XSA.

Is there any other way to get the audit logs?

Thank you in advance

[Bojan-lv-85]

Hi Blendi,

there are two common reasons for this: Either, the audit_log table is not getting populated or in other words: Your audit policy does not capture any events, or the user you are using to querying AUDIT_LOG does not have the AUDIT ADMIN system privilege.

BR, Bojan

[pjespinosa]

Hi Bojan,

thanks for replying, I'm also working with Blendi on this.

The user has AUDIT READ and also tried now with AUDIT ADMIN; we're reading the log with:

SELECT * FROM sys.audit_log

Does it make sense?

Many thanks & Regards

Pedro

[Bojan-lv-85]

Hi Pedro, does the table contain any records?

select count(*) from "SYS"."AUDIT_LOG"<br>

Could you provide a screenshot showing the overview of the active policies, or

select * from "SYS"."AUDIT_POLICIES"<br>

(I understand the sensitivity of this information, you might only want to include the relevant lines)

thx, Bojan

[pjespinosa]

Hi Bojan,

it has 5 records, please find policies below (no worries with sensitive data, it's a DEV system).

Thanks

Pedro

[Bojan-lv-85]

Hi Pedro,

and the output of

select count(*) from"SYS"."AUDIT_LOG"?

BR, Bojan

[pjespinosa]

Hi Bojan,

those are 5 records.

We solved the problem, the XSA logs are stored in a different view in the System Database:

SELECT * FROM xsa_audit_log

Many thanks & Regards

Pedro