SAP BTP CF Audit log viewer query

[TasSh]

We have a requirement to view all change logs (creation, modification , user assignment etc.) for a role collection for a period of 70 days. This is for Cloud Foundry subaccount.

Audit log viewer service caps at 500 entries & that is about 5 minute period for us (on an average).

Please let me know better way to search change logs for longer durations.

[Ivan-Mirisola]

Hi @TasSh,

According to the documentation below:

https://help.sap.com/docs/btp/sap-business-technology-platform/audit-log-retention-for-cloud-foundry...

You are able to retain data for a 90 days period. Any thing above that will require you to switch to the 'Premium' plan which allows you to define via support ticket a longer retention period and will be charged according to space stored.

Check the service plan 'Premium' description under the BTP Discovery Center:

https://discovery-center.cloud.sap/serviceCatalog/audit-log-service?region=all&tab=service_plan&comm...

I suppose you could open a ticket at SAP under the component BC-CP-CF-SEC-AUDITLG and check if the default plan can be configured from the 7 days retention to anywhere between 90 days (stated as the maximum amount for the free plan on the documentation above).

Best regards,
Ivan

Best regards,
Ivan

[TasSh]

Hi Ivan,

Thank you!

We will move to premium plan in near future.

Regarding my query , from what I see in system, retention is not an issue. I can see logs from February. It is just that logs from Audit log viewer service are capped at 500 in result screen . Do you think there is a way to remove that upper limit? 

Do you think logging a ticket under BC-CP-CF-SEC-AUDITLG would help answer this?

Kind Regards,

Tasmeem

[Ivan-Mirisola]

Hi @TasSh,

I don't think there is a way to configure the web view of such logs.

However, you should be able to download the logs files somehow. If not on the web view itself, you can request SAP support team for the full logs files whenever needed. As far as I remember, the log viewer has a download button on the right-hand side of the UI (a down-arrow icon with no text) - At least it is like so for the regular application logs - which I don't recall being different for audit logs.

Best regards,
Ivan

[TasSh]

Thank you , Ivan !

The downloaded .JSON file has the same entries as result screen (only difference it is in one place where as on UI results are divided into pages).

I have created a ticket for support team to pursue this further