Skip to Content

SM21 logs and 9 months retention period?

Hi,

I have been asked to extend the availability of the SM21 logs to 9 months. I have estimated that each file would then be something like 500GB and we have 10 application instances. A security compliance officer here wants to look for "interesting" things in them but I am very reluctant to make the changes needed as I fear what will happen when he does a global read from all files at the same time with such huge files.

What is the SAP best practice for the SM21 logs?

How do you handle requests like this?

I would really appreciate some input on this topic.

best regards,
Kristian

Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

3 Answers

  • Best Answer
    Jan 06, 2015 at 10:26 AM

    1st of all - Nine months of data in such cases would eat up lots of CPUs, I/O and memory 😊.

    However, reading should be easy if filters are used smartly. You cannot load a 500 gig file for reading. Also, the sum of all files should be 500 gigs per application server, so 500 gig is already segregated at OS level. All is need to do the same from SAP level using filters.

    If your officer is still not concerned with after-effects, give him the access in non-business hours.

    For rest, Deepak has already answered your query,

    Regards,

    Add comment
    10|10000 characters needed characters exceeded

  • Jan 06, 2015 at 07:23 AM

    Hi Kristian,

    You may look at tuning this parameter values to achieve desired results.

    rslg/max_diskspace/local

    rslg/central/file

    rslg/central/old_file

    To store 9 months of data you may need enough disk space and adjust the value of parameter rslg/max_diskspace/local to appropriate value.

    Hope this helps.

    Regards,

    Deepak Kori

    Add comment
    10|10000 characters needed characters exceeded

    • Hi Kristian,

      It is obvious that reading such huge data will have some performance impact.

      Suggestion here would be

      1) Perform system log reads using filters like only errors or only warnings etc.

      2) Perform system log reads at low load time when there are very minimal business users or on holidays .

      Regards,

      Deepak Kori

  • Jan 06, 2015 at 11:25 AM

    Thank you for the input. Having talked to the person and convinced him that it's not the best solution to what he want we have now decided to go another route.

    regards,

    Kristian

    Add comment
    10|10000 characters needed characters exceeded