SM21 logs and 9 months retention period?

[former_member200236]

Hi,

I have been asked to extend the availability of the SM21 logs to 9 months. I have estimated that each file would then be something like 500GB and we have 10 application instances. A security compliance officer here wants to look for "interesting" things in them but I am very reluctant to make the changes needed as I fear what will happen when he does a global read from all files at the same time with such huge files.

What is the SAP best practice for the SM21 logs?

How do you handle requests like this?

I would really appreciate some input on this topic.

best regards,
Kristian

[divyanshu_srivastava3 · Accepted solution]

1st of all - Nine months of data in such cases would eat up lots of CPUs, I/O and memory .

However, reading should be easy if filters are used smartly. You cannot load a 500 gig file for reading. Also, the sum of all files should be 500 gigs per application server, so 500 gig is already segregated at OS level. All is need to do the same from SAP level using filters.

If your officer is still not concerned with after-effects, give him the access in non-business hours.

For rest, Deepak has already answered your query,

Regards,

[former_member200236]

Thank you for the input. Having talked to the person and convinced him that it's not the best solution to what he want we have now decided to go another route.

regards,

Kristian

[former_member188883]

Hi Kristian,

You may look at tuning this parameter values to achieve desired results.

rslg/max_diskspace/local

rslg/central/file

rslg/central/old_file

To store 9 months of data you may need enough disk space and adjust the value of parameter rslg/max_diskspace/local to appropriate value.

Hope this helps.

Regards,

Deepak Kori

[former_member200236]

Hi Deepak,

Thank you for the reply. I know what to change but I am worried about a system hang of performance impact when trying to read huge amounts of data through SM21.

any thoughts about that?

regards,

Kristian

[former_member188883]

Hi Kristian,

It is obvious that reading such huge data will have some performance impact.

Suggestion here would be

1) Perform system log reads using filters like only errors or only warnings etc.

2) Perform system log reads at low load time when there are very minimal business users or on holidays .

Regards,

Deepak Kori