Skip to Content

No SM21 Log

Hi All

I m trying to fetch logs from Tcode-SM21. However I m not able to see records in output screen. I already tried different methods like System Log--Choose--All Remote system Logs. Also tried selecting all options setting--system log layout--selected all option. Still I m not able to see any records.

profile-parameter.jpg

sm21-input-screen.jpg

sm21-output-screen.jpg

I also tried by specifying user at the input screen & even that shows blank result.

I want to send SM21 log to auditor. I also tried SM20 for which user was not maintained at SM19. ST03N only shows Tcodes used by this user but not his activity like SM20 or SM21.

Regards

Pankaj

Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

3 Answers

  • Feb 10 at 11:46 AM

    You are looking for logs from the 25-09-2018 until 31-12-2018. Logs are written in a cyclical way and old messages have been replaced with new entries now. Check if you are able to see the recent ones and if yes old ones are overwritten.

    Add comment
    10|10000 characters needed characters exceeded

    • Pankaj,

      System logs are not deleted by any house keeping jobs or reports. They are not renamed to a new file with a ".old" extension like you observe in the work directory of the instance for developer traces when you restart the instance. The file is basically overwritten with new contents in a cyclical way, means old entries will be replaced with new ones. System logs are not stored anywhere else. There is nothing much you can do here.

      Cheers

      RB

  • Feb 11 at 10:00 AM

    Also, if you system has been restarted since, your logs would have been overwritten... or moved to .old

    Regards, JP

    Add comment
    10|10000 characters needed characters exceeded

    • Unfortunately, No... only the Security Audit log provides a long term output of the transactions executed in the system by a User, if not enabled you are limited to the standard tools like STAT/D or ST03N that hold the info for one or two days...

      Regards, JP

  • Feb 11 at 02:12 PM

    Hello Pankaj,

    About your comments on Juan's reply:

    (a), those are job logs (logs for batch jobs that you can see in the transaction SM37), not related to the system log (SM21).

    (b), SM21 would not show you the information mentioned at this item. To gather this information, you would need a security log (SM19/SM20). If the information is not on SM19/SM20 anymore, check whether you have a backup from the "DIR_AUDIT" folder (default path is: "/usr/sap/<SID>/<Instance Name>/log") that has the audit files covering the period that you need.

    Regards,

    Isaías

    Add comment
    10|10000 characters needed characters exceeded

    • Hello Pankaj,

      I am not aware of any tcode or report that would show what the user did within each tcode.

      Maybe the SAP GRC offers that feature, but I am not sure (I do not work with the SAP GRC product).

      In any case, installing a GRC system now would not provide information from the past.

      Regards,

      Isaías