{"id":7485,"date":"2020-11-11T16:16:47","date_gmt":"2020-11-11T16:16:47","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/introduction-to-sap-security-audit-log\/"},"modified":"2026-11-03T19:28:42","modified_gmt":"2026-11-03T19:28:42","slug":"introduction-to-sap-security-audit-log","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/introduction-to-sap-security-audit-log\/","title":{"rendered":"Introduction to SAP Security Audit Log"},"content":{"rendered":"<p><strong>&nbsp;Overview<\/strong><\/p>\n<p>This post introduces the SAP\u00ae Security Audit Log.<\/p>\n<p>According to&nbsp;<a href=\"https:\/\/help.sap.com\/doc\/saphelp_nw73ehp1\/7.31.19\/en-US\/c7\/69bcb7f36611d3a6510000e835363f\/frameset.htm\">SAP<\/a>,&nbsp;The Security Audit Log records &#8220;security-related system information such as changes to&nbsp;user master records or unsuccessful login attempts. This log is a tool designed for auditors who need to take a detailed look at what occurs in the AS ABAP system. By activating the audit log, [the SAP system keeps a record] of those activities that you specify for your audit. <em>Customers<\/em> can then access this information for evaluation in the form of an audit analysis report.<\/p>\n<p>\n&#8220;The Security Audit Log provides for long-term data access. The audit files are retained until you explicitly delete them. Currently, the Security Audit Log does not support the automatic archiving of the log files; however, you can manually archive them at any time.<\/p>\n<p>&#8220;You can record the following information in the Security Audit Log:<\/p>\n<ul>\n<li>Successful and unsuccessful dialog login attempts<\/li>\n<li>Successful and unsuccessful RFC login attempts<\/li>\n<li>RFC calls to function modules<\/li>\n<li>Changes to user master records<\/li>\n<li>Successful and unsuccessful transaction starts<\/li>\n<li>Changes to the audit configuration<\/li>\n<\/ul>\n<p>According to <a href=\"https:\/\/www.enterprise-threat-monitor.com\/sap-log-analysis\/\">Enterprise Threat Monitor<\/a>,&nbsp;&#8220;SAP security audit log is the main location for the traces of events triggered by the&nbsp;system or by applications, which are related to security. [It is in the form of a table.] &nbsp;Based on the configuration in which event types must be recorded, it saves the data to the disk on the SAP application server instance.&#8221; Specify the audit file&#8217;s location by setting the profile parameter, <strong>rsau\/local\/file<\/strong>, in the SAP system.&nbsp;<\/p>\n<p>\nA <a href=\"https:\/\/blogs.sap.com\/2016\/05\/17\/sap-security-audit-logs-which-event-types-should-i-enable-there-are-90-of-them\/\">SAP blog<\/a>&nbsp;adds: &#8220;Since security audit logs are stored on the file system and not the database, they&nbsp;<em>do not impact performance<\/em>. The main consideration of the operations teams is the storage requirements. Based on the activated event types (audit classes), the data volume [can vary].&#8221;<\/p>\n<p><strong>Configuration of Security Audit log<\/strong><\/p>\n<p>There are two configuration options in the security audit log:<\/p>\n<ul>\n<li>Set Profile parameters<\/li>\n<li>Use appropriate filter configuration using SM19 or RSAU_CONFIG<\/li>\n<\/ul>\n<p><strong>&nbsp;1. Profile parameters&nbsp;&nbsp;<\/strong><\/p>\n<p>Set profile parameters based on your release.<\/p>\n<p>A) For releases earlier than 740: In the default profile, <strong>default.pfl<\/strong>, of the system,&nbsp;set the following profile parameters:<\/p>\n<p><em>&nbsp; &nbsp;&#8211; rsau\\\/enable=1<br \/>\n&nbsp; &nbsp;&#8211; rsau\\\/user\\_selection=1<br \/>\n&nbsp; &nbsp;&#8211; rsau\\\/selection_slots=10 (or higher)<br \/>\n&nbsp; &nbsp;&#8211; rsau\\\/integrity=1 (if available &#8211; see SAP Notes 2033317 and 1810913)<\/em><\/p>\n<p>B)<em> <\/em>For releases 740 to 751: Call transaction SM19. Activate the Security&nbsp;Audit Log by performing the following steps:<\/p>\n<p>&nbsp; &nbsp;1. Select the <strong>Security Audit active<\/strong>&nbsp;checkbox on the <strong>Kernel Parameters<\/strong>&nbsp;tab.&nbsp;<br \/>\n&nbsp; &nbsp;2. Activate both <strong>Generic User Selection<\/strong>&nbsp;and <strong>Integrity Protection Format<\/strong>.&nbsp;<br \/>\n&nbsp; &nbsp;3. Set the number of selection filters to at least 10.&nbsp;<\/p>\n<p>C) For releases 752 and later: Call transaction RSAU_CONFIG. Activate the Security Audit<br \/>\n&nbsp; &nbsp;Log in by performing the following steps:<\/p>\n<p>&nbsp; &nbsp;1. Select the <strong>Static security audit active<\/strong>&nbsp;checkbox under<br \/>\n&nbsp; &nbsp; &nbsp; <strong>Security Audit Log Configuration -&gt; Parameters<\/strong>&nbsp;in the tree.&nbsp;<br \/>\n&nbsp; &nbsp;2. Activate both <strong>Generic User Selection<\/strong>&nbsp;and <strong>Integrity protection format active<\/strong>.&nbsp;<br \/>\n&nbsp; &nbsp;3. Set the <strong>Number of Filters per Profile<\/strong>&nbsp;to 10, which is the minimum requirement.<\/p>\n<p><strong>Note:<\/strong> When you use the Kernel parameters in the Security Audit Log configuration (step 1B or 1C), existing settings with the same name in the system&#8217;s profile are ignored. For more information, see&nbsp;<a href=\"https:\/\/sapsecuritystuff.files.wordpress.com\/2017\/05\/sap-note-539404_faq-for-audit-logs.pdf\">SAP Note 539404<\/a>&nbsp;&#8211; Answer 1 a<br \/>\n&nbsp;<\/p>\n<p><strong>2. Setting up appropriate filter configurations&nbsp;<\/strong><\/p>\n<p>\nTo set up filters, perform the following steps:<\/p>\n<p>1. Call transaction <strong>SM19<\/strong>&nbsp;or <strong>RSAU_CONFIG<\/strong>. Create a new profile.&nbsp;<\/p>\n<p>2. Create the following filters:<\/p>\n<p>&nbsp; &nbsp;&#8211; All clients (`*`), user `SAP#*`: Record all events. The character `#` serves to mask<br \/>\n&nbsp; &nbsp; &nbsp;`*` as non-wildcard.<br \/>\n&nbsp; &nbsp;&#8211; All clients (`*`), user `&lt;your emergency user IDs&gt;*`: Record all events.<br \/>\n&nbsp; &nbsp;&#8211; Client 066, all users (`*`): Record all events.<br \/>\n&nbsp; &nbsp;&#8211; All clients (`*`), all users (`*`): Record all events except AUW, AU5, AUK, CUV, DUR,<br \/>\n&nbsp; &nbsp; &nbsp;and EUE (deactivate via <strong>Detailed Display<\/strong>).<\/p>\n<p>3. Save and activate the profile.<\/p>\n<p>4. Finally, check the configuration. If you have made changes to the profile parameters or&nbsp;the static profile, restart the system to make them effective. Until you can restart the system: Convert the static profile to a dynamic profile and activate it.<\/p>\n<p><strong>Analysis of the Security Audit log<\/strong><\/p>\n<p>Call transaction <strong>SM20\/SM20N<\/strong>, or its equivalent transaction depending on your SAP Netweaver version (see the following table), and give the required selection criteria as input. Click <strong>Reread Audit log<\/strong>&nbsp;to get the configured audit log for your system.<\/p>\n<p><strong>Table: Old and New functions of Transactions and reports related to the Security Audit Log<\/strong><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26424-body-Picture1_34.png\" alt=\"Sap AUdit pic 1\" \/><\/p>\n<p><a href=\"https:\/\/blogs.sap.com\/2014\/12\/11\/analysis-and-recommended-settings-of-the-security-audit-log-sm19-sm20\/#jive_content_id_Recommended_Settings_for_the_Security_Audit_Log_SM19__SM20](https:\/\/blogs.sap.com\/2014\/12\/11\/analysis-and-recommended-settings-of-the-security-audit-log-sm19-sm20\/#jive_content_id_Recommended_Settings_for_the_Security_Audit_Log_SM19__SM20\"><em>Table Source<\/em><\/a>&nbsp;<\/p>\n<p>According to a&nbsp;<a href=\"https:\/\/blogs.sap.com\/2014\/12\/11\/analysis-and-recommended-settings-of-the-security-audit-log-sm19-sm20\/\">SAP blog post<\/a>&nbsp;&#8220;You can view the long text of the Security Audit Log event messages using transaction&nbsp;<strong>SE92<\/strong>&nbsp;(or in transaction <strong>SE61<\/strong>&nbsp;if you choose the document class SL (Syslog). Using&nbsp;<a href=\"https:\/\/launchpad.support.sap.com\/#\/notes\/1970644\">note 1970644]<\/a>, you can get report&nbsp;<strong>RSAU\\_INFO\\_SYAG<\/strong>&nbsp;which shows all the events of the Security Audit Log including the&nbsp;current status of activation. The detail view allows you to create an HTML-based event&nbsp;definition print list including the full documentation.&#8221;<\/p>\n<p>It primarily depends on customer requirements to enable all successful and non-successful<br \/>\nevents for all clients and users. The&nbsp;<a href=\"https:\/\/blogs.sap.com\/2014\/12\/11\/analysis-and-recommended-settings-of-the-security-audit-log-sm19-sm20\/\">SAP post<\/a>&nbsp;continues: &#8220;There is no performance impact, not in time nor in space, if you log&nbsp;unsuccessful (=critical) events as these events happen rarely. As soon as you start logging&nbsp;successful events you might look to space&#8212;the growing size of the audit&nbsp;files\u00ae but still not to time, as the Security Audit Log is optimized for speed.&#8221;<\/p>\n<p>\nSAP offers functionality to email Security Audit Logs with the help of reports<br \/>\n<strong>RSAU\\_SELECT\\_EVENTS<\/strong>&nbsp;or <strong>RSAU\\_READ\\_LOG<\/strong>. Schedule any of these reports as a background&nbsp;job to receive the audit log from the SAP system.<\/p>\n<p>The following table gives an overview of the critical events messages stored in the audit<br \/>\nlog for different audit classes.<\/p>\n<p>**Table: Critical events of Dialog, Transaction, RFC, and User audit classes**&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26424-body-Picture2_29.png\" alt=\"sap audit pic 2\" \/><\/p>\n<p><a href=\"https:\/\/blogs.sap.com\/2014\/12\/11\/analysis-and-recommended-settings-of-the-security-audit-log-sm19-sm20\/#jive_content_id_Recommended_Settings_for_the_Security_Audit_Log_SM19__SM20\"><em>Table source<\/em><\/a>:<\/p>\n<p><strong>Conclusion<\/strong><br \/>\nSwitching on Security Audit log for all the clients and users is a crucial step in security as it provides detailed information on the audit reports. Its benefits far outweigh its costs and provides long-term data access. I strongly recommend that you enable the Security Audit log, especially in production environments.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction to SAP Security Audit Log<\/p>\n","protected":false},"author":2,"featured_media":7487,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26424","content_type":"blog","created_by":"10130","authored_on":"2023-12-31T16:16:47+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Chakrala Vinodh, SAP Database Administrator, Rackspace Technology","seo_description":"Understand the functionalities of SAP's Security Audit Log that records critical system information from a security standpoint.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26424-insights_image-productivity-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"SAP","product":"","publisheddate":"2020-11-11T16:16:47","rxt_solutions":"Applications, Application Management & Operations, Application Modernization","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"SAP Security Audit Log | Rackspace Technology","field_topics":"","field_slug":"introduction-to-sap-security-audit-log","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7485","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=7485"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7485\/revisions"}],"predecessor-version":[{"id":9488,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7485\/revisions\/9488"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/7487"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=7485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=7485"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=7485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}