Firefighter logs

[Former Member]

Hi Gurus,

This is regarding the Firefighter logs.

I am using the transaction /n/virsa/vfat for extracting the firefighter logs.

The details whch i get here are the Date , Time and the Tcodes which are used by the user for each logon session.

I need to further more details :

eg. if a user has used the transaction SE38, I need to get further details like what report the user has executed or what activities are performed using SE38.

Kndly let me know if there are any tables/tcodes which would help me find it out.

Thanks in Advance.

Swapnil

[former_member187989]

Please close this thread. Post it in forum [SAP Community Network Forums » SAP NetWeaver » Security |;

[Former Member]

Moved to the GRC forum.

GRC poaches data via table MONI and at the application level it is "translated" for certain tcodes as many reports might hide behind them.

Examples are also GR55, SARE, etc.

You might as well use the standard functionality in SAP in my opinion (audit log, ST03n, STAD, etc) as such "special logs" are normally just a presentation cockpit for them with additional risks of UI bugs and using unreleased functions.

Rather try to minimize the "emergencies" by building solid roles, and then report on the use of exceptions and only give it to people whom you trust. That takes care of 99,9% of hassles.

For the rest you need to use forensic tools and it is case specific. There is no cockpit for forensics.

My 2 cents (after having tried to create one),

Julius

[Former Member]

Hi Swapnil,

Which version/sp level are you on? FF should log reports executed with SE38.

From Note 1290062 - How Firefighter picks up Change Log data (CLOG) for transact

- SE38: Data for SE38 is also picked in two phases.

First Phase the data is picked from STAT file.

Second Phase data is picked using SAP standard function module:

CHANGEDOCUMENT_READ.

[simon_persin4]

In the configuration table, make sure that you have the "Retrieve Change Logs" parameter set to yes.

It is not 100% complete but you will then get the majority of activites performed by the users rather than just the list of transactions used.

A word of warning though, you may wish to implement an index on table CDHDR to guard against performance issues.

Simon

[Former Member]

You have to be very carefull of indexes, because code which updates the tables will be slowed down by them.

Writing change documents is a famous performance bottleneck, and this one is the central one for many applications!

Cheers,

Julius

[Former Member]

yes you have to set 'Retrieve change Log' to 'YES'.

it will show program name only if user opens that in change mode.

index can be created, there is SAP note for that (please search ) by GRC

which version of Firefighter you are using.

some customers are still on old 3.0 ones, they don't have this parameter in config tab

Regards,

Surpreet Bal