Old audit logs disappeared

[Former Member]

Hi All,

I'm trying to read audit logs of last 1 week but I couldn't see anything before 19th of May. However, I could read logs from 20th to till date.

Below are the parameters

DIR_AUDIT/usr/sap/PA1/D00/log

FN_AUDITaudit_++++++++

rsau/enable1 rsau/integrity0

rsau/log_peer_address0

rsau/max_diskspace/local1000000000

rsau/max_diskspace/per_day0

rsau/max_diskspace/per_file0

rsau/selection_slots2

rsau/user_selection0

If something is wrong with paramters, it shouldn't display log at all but it is only not showing more than 3 days old data.

Kindly help.

Thanks,

Uday.

[patelyogesh]

Hello Uday Bhaskar Raghupatula,

Are you talking about SM19 and SM18?

After every 10 files log gets overwritten but you can specify how big file you want to generate.

If you taking backup of instance directory please look in to your backups. Hope no one deleted it.

Please also check SAP Note : 539404 - FAQ: Answers to questions about the Security Audit Log

Thank you

Yogesh

[Former Member]

Hi Yogesh,

Thanks for response.

Yes, I'm taking about SM20/SM19. And above parameters is from SM19.

I understood that log files gets overwritten after 10 days and also we can define how big the log file should be. But here I couldn't able to see more than 3days old data.

For example, today(4th July) I could see data from 2nd July but not 1st July data or 30th June data.

If you taking backup of instance directory please look in to your backups. >>> What do you mean by this? How can we check audit logs from back up?

I went thru SAP Note 539404 but no where mentioned about this parameter or issue.

Thanks in advance,

Uday.

[patelyogesh]

Hi Uday Bhaskar Raghupatula,

There is one archived discussion please have a look at it

https://archive.sap.com/discussions/thread/1180025

Thank you

Yogesh