Skip to Content

Audit log in SM19/20

Hi All,

I have a question on how to define the maximum number of the log to be kept in SAP? is there a parameter to define in RZ10?

because currently the log generated by SM19 been deleted after 3 months and I checked the total size are less than 100MB, while the current system is being setup to maximum 200MB.

Another question would be, is there a way to get back the deleted logs by the system?

Thank you,

Regards,

Ura

Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

3 Answers

  • Best Answer
    Jan 08, 2015 at 11:24 AM

    Hi

    1. If there is deletion of logs older than 3 months, you have job running for this. Simply change number of days to your needed maximum.

    2. Restore audit_* files from backup to location /usr/sap/<SID>/<instno>/log/

    Regards

    Przemek

    Add comment
    10|10000 characters needed characters exceeded

    • Cool,

      so I created a variant of KEEP_180days and save it.

      while editing the job in SM37 I put KEEP_180days in the parameters field.

      so by right the job should delete logs that older than 180days now?

      Thank you,


      Regards,

      Ura

  • avatar image
    Former Member
    Jan 08, 2015 at 05:03 AM

    HI Ura,

    Please check with tcode Sm18 and check the profile parameters listed in the below link:

    The Security Audit Log - Auditing and Logging - SAP Library

    Asad

    Add comment
    10|10000 characters needed characters exceeded

    • Hi Asad,

      I checked all the profiles but it does not indicate how long it can be kept for.

      Perhaps I have an job that delete the log every 90 days, need to look into this matter.

      Regards,

      Ura

  • avatar image
    Former Member
    Jan 09, 2015 at 08:43 AM

    Ura,

    I assume that RSAUPURG(SM18) must have been scheduled as bacth job for every 90 days. Verify this by checking in SM37 ?

    If yes, increase the frequency to keep logs for long time.

    Note : Have increased the memory size to store your audit logs (rsau/max_diskspace_local) as per the needs

    Thansk,Krishna

    Add comment
    10|10000 characters needed characters exceeded

    • Former Member Ura Uramasa

      I overlooked your comment about frequnecy.

      You need to mention the value(i.e no of days  -XX days) in Variant (SM37->step->can change).

      So that whnever batch job runs(Job frequency) , it will delete the logs which are XX days older.

      Thansk,Krishna