Skip to Content
author's profile photo Former Member
Former Member

Audit Log stopped recording

Hi Experts,

Audit log in SM20 shows The result set for this selection was empty Message no. SL406.
I stopped all of sudden.

Audit Log was active
All the filter were active

I checked the size of audit log file /usr/sap/<SID>/<Inst>/log which was growing

Thanks in Advance

Add a comment
10|10000 characters needed characters exceeded

Related questions

5 Answers

  • Posted on Jan 07, 2014 at 11:16 PM

    Hi Anil,

    kindly check the below thread

    Getting message : The result set for this selec... | SCN

    and also the sap note

    875835 - SecAudit: Analysis finds no audit events

    With Regards

    Ashutosh Chaturvedi

    Add a comment
    10|10000 characters needed characters exceeded

  • author's profile photo Former Member
    Former Member
    Posted on Jan 08, 2014 at 12:33 AM

    Hi Anil

    Are you able to see that the audit configurations are active in SM19 ? Sometimes when the max size of the audit file is reached , then recording gets automatically stopped.

    Please see the following FAQ note giving good information about Audit Logs

    539404 - FAQ: Answers to questions about the Security Audit Log

    Thanks

    Rishi

    Add a comment
    10|10000 characters needed characters exceeded

  • Posted on Jan 08, 2014 at 04:30 AM

    Hi Anil,

    Pls refer below notes ,

    441639Security Audit: No evaluation occurs in transaction SM20

    107417SecAudit: configuration with SM19 / no. of filters (slots)

    check below threads for similar error,

    http://scn.sap.com/thread/3381876

    SAP security audit log setup | Sap Basis Information


    Regards

    Nayeem

    Add a comment
    10|10000 characters needed characters exceeded

  • Posted on Jan 08, 2014 at 05:52 AM

    Normally Audit log stops when you restart the system, did you performed system restart recently ??

    That might be the issue.

    Thanks and regards,

    Jayadeep

    Add a comment
    10|10000 characters needed characters exceeded

  • Posted on Jan 08, 2014 at 07:24 AM

    HI, Anil ,

    you did not mention for activat the Audit Parameters which is required , it might be the issue , because the audit log will stop if you did not activate it from parameter after performing Application restart

    check the value of the following parameter

    DIR_AUDIT Directory for security audit files

    FN_AUDIT Name of security audit file

    rsau/enable Enable Security Audit

    rsau/max_diskspace/local Maximum space for security audit file

    rsau/max_diskspace/per_day Maximum size of all security audit files per day

    rsau/max_diskspace/per_file Maximum size of one security audit file

    rsau/selection_slots Number of selection slots for security audit

    rsau/user_selection Defines the user selection method used inside ke

    Best Regards

    AhMeD

    Add a comment
    10|10000 characters needed characters exceeded

Before answering

You should only submit an answer when you are proposing a solution to the poster's problem. If you want the poster to clarify the question or provide more information, please leave a comment instead, requesting additional details. When answering, please include specifics, such as step-by-step instructions, context for the solution, and links to useful resources. Also, please make sure that you answer complies with our Rules of Engagement.
You must be Logged in to submit an answer.

Up to 10 attachments (including images) can be used with a maximum of 1.0 MB each and 10.5 MB total.