Audit log in SM19/20

[Former Member]

Hi All,

I have a question on how to define the maximum number of the log to be kept in SAP? is there a parameter to define in RZ10?

because currently the log generated by SM19 been deleted after 3 months and I checked the total size are less than 100MB, while the current system is being setup to maximum 200MB.

Another question would be, is there a way to get back the deleted logs by the system?

Thank you,

Regards,

Ura

[Former Member]

HI Ura,

Please check with tcode Sm18 and check the profile parameters listed in the below link:

The Security Audit Log - Auditing and Logging - SAP Library

Asad

[Former Member]

Hi Asad,

I checked all the profiles but it does not indicate how long it can be kept for.

Perhaps I have an job that delete the log every 90 days, need to look into this matter.

Regards,

Ura

[Private_Member_69416]

Hi

1. If there is deletion of logs older than 3 months, you have job running for this. Simply change number of days to your needed maximum.

2. Restore audit_* files from backup to location /usr/sap/<SID>/<instno>/log/

Regards

Przemek

[Former Member]

Hi Prze,

How do I know which job that delete it after 90 days?

Thank you,

Regards,

Ura

[Private_Member_69416]

Try to find job with program RSAUPURG

[Former Member]

I'm able to see there is a scheduled daily on RSAUPURG but where do I set to XX days parameters?

because I do not wish to alter it to 12 months frequency.

Thank you,

Regards,

Ura

[Private_Member_69416]

in program variant

check what id you are using and modify

[Former Member]

Cool,

so I created a variant of KEEP_180days and save it.

while editing the job in SM37 I put KEEP_180days in the parameters field.

so by right the job should delete logs that older than 180days now?

Thank you,

Regards,

Ura

[former_member298454]

Ura,

I assume that RSAUPURG(SM18) must have been scheduled as bacth job for every 90 days. Verify this by checking in SM37 ?

If yes, increase the frequency to keep logs for long time.

Note : Have increased the memory size to store your audit logs (rsau/max_diskspace_local) as per the needs

Thansk,Krishna

[Former Member]

it says in here (SM18) is daily scheduled, so how come it can retain up to 90 days?

it there a way I can set the parameter 90 days to XX somewhere?

[former_member298454]

I overlooked your comment about frequnecy.

You need to mention the value(i.e no of days  -XX days) in Variant (SM37->step->can change).

So that whnever batch job runs(Job frequency) , it will delete the logs which are XX days older.

Thansk,Krishna