Audit Log stopped recording

[Former Member]

Hi Experts,

Audit log in SM20 shows The result set for this selection was empty Message no. SL406.
I stopped all of sudden.

Audit Log was active
All the filter were active

I checked the size of audit log file /usr/sap/<SID>/<Inst>/log  which was growing

Thanks in Advance

[ahmed_ibrahim2]

HI, Anil ,

you did not mention for activat the Audit Parameters which is required ,  it might be the issue , because the audit log will stop if you did not activate it from parameter after performing Application restart

check the value of the following parameter

DIR_AUDIT                               Directory for security audit files

FN_AUDIT                                 Name of security audit file

rsau/enable                               Enable Security Audit

rsau/max_diskspace/local        Maximum space for security audit file

rsau/max_diskspace/per_day  Maximum size of all security audit files per day

rsau/max_diskspace/per_file   Maximum size of one security audit file

rsau/selection_slots                 Number of selection slots for security audit

rsau/user_selection                 Defines the user selection method used inside ke

Best Regards

AhMeD

[former_member215345]

Normally Audit log stops when you restart the system, did you performed system restart recently ??

That might be the issue.

Thanks and regards,

Jayadeep

[Former Member]

Hi,

If you are saying that the logs are increasing then it shoudl be active.

can you please go in sm19 and see in the dynamic tab what do toy see and if it is active.

if active can you see the data when you run the report.

RSAU_SELECT_EVENTS

Thanks

Rishi Abrol

[Former Member]

Hi Rishi,

I ran the report i cannot see any data.
When i see the file through AL11 it was growing from time to time.
Do i need to Activate the logs again?
My main concern is find the reason why they stopped all of sudden, was there any way to find out.

Thanks & Regards,

Anil

[Former Member]

Hi Rishi,

After Running a report RSAU_SELECT_EVENTS when i give the audit directory path nad name in Optional: Archive Audit Files section i can read the file.

but I cannot read the file from SM20

Any changes i have to make in SM19 pr SM20

Thanks & Regards,

Anil

[Former Member]

Hi,

Sm20 also call the same program it can be that you system is not able to read this two parameters. As when you give the path the program can read it the file.

Parameter	Description
DIR_AUDIT	Directory for security audit files
FN_AUDIT	Name of security audit file

Can also check the below link.

http://help.sap.com/saphelp_nw73ehp1/helpdata/en/97/51acc340474445ade287ff397706b9/content.htm

Thanks

Rishi Abrol

[former_member45419]

Hi Anil,

Pls refer below notes ,

441639

Security Audit: No evaluation occurs in transaction SM20

107417

SecAudit: configuration with SM19 / no. of filters (slots)

check below threads for similar error,

http://scn.sap.com/thread/3381876

SAP security audit log setup | Sap Basis Information

Regards

Nayeem

[Former Member]

Hi Anil

Are you able to see that the audit configurations are active in SM19 ?  Sometimes when the max size of the audit file is reached , then recording gets automatically stopped.

Please see the following FAQ note giving good information about Audit Logs

539404 - FAQ: Answers to questions about the Security Audit Log

Thanks

Rishi

[former_member185239]

Hi Anil,

kindly check the below thread

Getting message : The result set for this selec... | SCN

and also the sap note

875835 - SecAudit: Analysis finds no audit events

With Regards

Ashutosh Chaturvedi

[Former Member]

Hi Ashutosh,

I already checked the thread you mentioned, but it didn't fit my case.
Logs were recording fine, but stopped all of sudden yesterday.

Thanks & REgards,