SM20 log missing due to max file size reached

[Former Member]

Hi experts,

In one of our system sm20 log is incomplete because max file size reached.

Is there any possibility to get the complete data from any other table or from OS level?

[ACE-SAP]

Hello

You cannot recover from any table what has not been recorded in log files.

But you audit log should be able to automatically create new files and can only get stuck if file system gets full.

Check your parameters, make sur FN_AUDIT is correctly set and increase

rsau/max_diskspace/local

rsau/max_diskspace/per_day

rsau/max_diskspace/per_file

Regards

FN_AUDIT

The name must include eight (8) '+' in sequence (which the system substitutes with the current date) followed by (6) "#" (which the system replaces with a sequential number).

FN_AUDIT = AUDIT_++++++++_######.AUD

Name	Description
DIR_AUDIT	Directory for security audit files
FN_AUDIT	Name of security audit file
rsau/enable	Enable Security Audit
rsau/max_diskspace/local	Maximum space for security audit file
rsau/max_diskspace/per_day	Maximum size of all security audit files per day
rsau/max_diskspace/per_file	Maximum size of one single security audit file
rsau/selection_slots	Number of selection slots for security audit
rsau/user_selection	Defines the user selection method used inside kernel functions

539404 - FAQ: Answers to questions about the Security Audit Log

909738 - SecAudit: Files are created with other names

[Former Member]

Thanks Yves!

The different files are available but the problem here is logging stopped due to max file size reached.

Records are not available for 2nd half of the day.

New log will start next day as today's file size exceeded the permissible size

[Former Member]

Thanks Yves!

The different files are available but the problem here is logging stopped due to max file size reached.

Records are not available for 2nd half of the day.

New log will start next day as today's file size exceeded the permissible size

[Former Member]

Hi Anjani,

You can check the SM20 log files which are written in the application server(DIR_LOGGING directory).

It's not that hard to check transaction SM20 to see what function modules are used by SAP. Basically, you are looking for function modules with name like RSAU_* such as RSAU_READ_FILE. Don't forget that if you remove audit files then you won't be able to read these files. So you can create your own custom table and schedule a simple report which will make a copy of audit records and then use this custom table in your report. Also don't forget that there is a security reason why audit records are written to file

Cheers

[Former Member]

Thanks Laxman!

Will this option recover the log which are not available for 2nd of the day?

[Former Member]

If the files are written in the application server, then the logs will be available even for the 2nd day.

Else you cannot get the logs.