Fire Fighter Logs details in /n/virsa/vfat

[Former Member]

Hi,

When i see the Fire Fighter logs through the Tcode /n/virsa/vfat, i am just able to know what tcode was used by a particular user and at what time and date.

Now if he has used SE38, i do not get the information of what report or program did he run in SE38. Similarly for SE16n I will not have the information of what table was used and modified.

So is it possible to know the complete details of the activity that user has done throught the FIreFighter.

Please help.

Regards

Anubhav

[Former Member]

In the case of SE16 you can see the generated selection-screen program for that table being submitted both in STAD if you are fast enough (i.e. before the aggregation takes place) and in the security audit log (SM20N - which is actually the correct tool to rely on). They will show reports from SA38 etc as well.

However SE16N does not generate and submit report type programs so you cannot know which table was accessed. The only little "skidmark" it will leave behind is the memory id entries of the tabname selection parameter and SQL performance traces, but GRC does not access this data and it is unreasonable to assume that the history of these memory ids has been activated on the server side.

If worst comes worse you will be able to find out the table though - latest with a thumb-screw or bamboo under the finder nails...

Cheers,

Julius

[martin_voros]

Hi,

the fire fighter log is composed from multiple sources. The programs executed in SE38/SA38 should be covered. Check note 1116229 for more info. There are more notes related to STAD and firefighter. But I don't think that tables previewed in SE16 are covered by any source.

Cheers