Read Security Audit Logs using only funtion modules

[Former Member]

Hi everyone!

We are trying to analyze the security audit logs in our system automatically. Just like the user in this question: https://archive.sap.com/discussions/thread/1617023 I need to download the logs that are usually accessed via sm20. The answer to the before mentioned question is based on using the abap report RSAU_READ_AUDITLOG_EXTERNAL, which perfectly contains the data I am looking for, but unfortunately I need to access it with function modules, since we're trying to read the data through RFCs. Unfortunately we can also not create our own function module and have to use the integrated ones.

I already used RSAU_READ_FILE to find & download one of the .AUD files, but the data is in some binary format, that is unusable to me.

So basically I am looking for either a function module that I can use to see the audit logs or some way to access the result of the abap report through a function module or something that helps me open/parse/analyze the .AUD files.

I appreciate your help & thank you in advance!

[alessandr0]

Hi Moritz,

what about function module RSAU_READ_LOG? That's remote enabled and should allow you to read the audit log from the file system.

Cheers, A

[Former Member]

Hi Alessandro,

first of all: Thank you very much for answering!

Unfortunately though, the fm RSAU_READ_LOG doesn't seem to exist or maybe isn't enabled in the system we're working on. I am trying to find out how we can enable it. In the meantime, do you maybe have any idea how I could make use of the files that for example RSAU_READ_FILE return? Is there maybe a function module that can parse/convert these files for me?

Thank you & best regards, Moritz