How to monitor user logon to SAP Server?

[Former Member]

Hi gurus,

Recently I find out one service user is locked from time to time, once I unlock this service user, after sereval days, this service user is locked again because of password verfication failure, I am trying to find out who, from which PC terminal, when try to login in SAP system using this service user.

do you have a good solution?

thanks, reward point if help

[Former Member · Accepted solution]

Hi,

Not a perfect solution but it could work :

Use transaction STAD to find the connection trials. There, in the details screens, you will find the IP address of the involved PC.

To know from which external system come a problem, I always create a different service user for each different external system and even if they call the same RFCs or web services.

An other advantage is that I am able to know the system load generated by each externa l system.

Hope this helps.

Regards,

Olivier

[Former Member]

It may be better to use SM19 to create an audit trace which can be limted to a particular client and user. Furthermore you can specify the type of audit class, in your case probably "RFC/CPIC logon" and "RFC call", perhaps even "Dialog logon"

Next, just run SM20 to look at the audit log to examine the result. You should see the various login attempts as well as the hostname from which the login was made.

Do not forget to disbled the trace once you have the desired info. These audit file can grow rather large.