Skip to Content
avatar image
Former Member

Firefighter logs

Hi Gurus,

This is regarding the Firefighter logs.

I am using the transaction /n/virsa/vfat for extracting the firefighter logs.

The details whch i get here are the Date , Time and the Tcodes which are used by the user for each logon session.

I need to further more details :

eg. if a user has used the transaction SE38, I need to get further details like what report the user has executed or what activities are performed using SE38.

Kndly let me know if there are any tables/tcodes which would help me find it out.

Thanks in Advance.


Add comment
10|10000 characters needed characters exceeded

  • Follow
  • Get RSS Feed

3 Answers

  • Sep 16, 2010 at 09:39 AM

    Please close this thread. Post it in forum [SAP Community Network Forums » SAP NetWeaver » Security |;

    Add comment
    10|10000 characters needed characters exceeded

  • avatar image
    Former Member
    Sep 16, 2010 at 08:53 PM

    Moved to the GRC forum.

    GRC poaches data via table MONI and at the application level it is "translated" for certain tcodes as many reports might hide behind them.

    Examples are also GR55, SARE, etc.

    You might as well use the standard functionality in SAP in my opinion (audit log, ST03n, STAD, etc) as such "special logs" are normally just a presentation cockpit for them with additional risks of UI bugs and using unreleased functions.

    Rather try to minimize the "emergencies" by building solid roles, and then report on the use of exceptions and only give it to people whom you trust. That takes care of 99,9% of hassles.

    For the rest you need to use forensic tools and it is case specific. There is no cockpit for forensics.

    My 2 cents (after having tried to create one),


    Add comment
    10|10000 characters needed characters exceeded

    • Former Member Simon Persin

      You have to be very carefull of indexes, because code which updates the tables will be slowed down by them.

      Writing change documents is a famous performance bottleneck, and this one is the central one for many applications!



  • avatar image
    Former Member
    Sep 21, 2010 at 08:49 PM

    yes you have to set 'Retrieve change Log' to 'YES'.

    it will show program name only if user opens that in change mode.

    index can be created, there is SAP note for that (please search ) by GRC

    which version of Firefighter you are using.

    some customers are still on old 3.0 ones, they don't have this parameter in config tab


    Surpreet Bal

    Add comment
    10|10000 characters needed characters exceeded