Audit Log - Table Log

Hi everyone,
Can anyone tell me if i activate table logging on a table (not customizing table) like MARC table, what information is saved in the system?.
Can I check or know, previous the audit log activation over this table, what fields or what information is recorded?
thanks,
HEPC

This is table logging for customizing type entries in not necessarily what you are looking for.
For master data you need to use the application change documents (table CDHDR etc) which is a different concept (I would use that route and protect the object S_ARCHIVE).
What you are actually looking for (and waiting for) is [the package concept at runtime|http://forums.sdn.sap.com/click.jspa?searchID=58483939&messageID=4675719] which developers can already see as warnings. It also means that the package which the table is assigned to must have a complete set of APIs.
I would personally not look for workarounds with performance impacts, but rather clean up the code to make it package concept conform, and then use the application change documents and not the table change records.
This is a better design - more sustainable, less hassles and auditable (via where-used-lists).
My 2 cents,
Julius

Similar Messages

Audit log of customized table.

Dear experts,
I need to trace log of some tables.
In spro transacction there is one customize transacction KEDE. This transacction is used to define derivation rules and generates entries with tables names. This records are generated in TKEDRS table. I do not need to audit this table. I need to audit some the tables recorded in field table of table TKEDRS.
K9XXXYYYNNNN.
XXX- ID SYSTEM
YYY- ID CLIENT
NNNN-Number
This custom point generates tables in dictionary. I need to trace this tables for audit log of changes. One solucion is configure SCU3 and tables in SE11.
This table do not have modification digalog. (cdhdr, cdpos, ... ) tables.
Are there other solution?
Thanks and regards.
David Sánchez.

Dear experts,
I need to trace log of some tables.
In spro transacction there is one customize transacction KEDE. This transacction is used to define derivation rules and generates entries with tables names. This records are generated in TKEDRS table. I do not need to audit this table. I need to audit some the tables recorded in field table of table TKEDRS.
K9XXXYYYNNNN.
XXX- ID SYSTEM
YYY- ID CLIENT
NNNN-Number
This custom point generates tables in dictionary. I need to trace this tables for audit log of changes. One solucion is configure SCU3 and tables in SE11.
This table do not have modification digalog. (cdhdr, cdpos, ... ) tables.
Are there other solution?
Thanks and regards.
David Sánchez.

Tables for audit logs

Dears,
I need to find out the table which maintain Audit/Security Log and can be access through ABAP or any other programming language.
I already have seen the reports from SM30 and SM31 but what i need is the tables from where these reports are fetch from.
Thanks & Regards,

Hi,
After I turn on audit trail on the database sever and issue DML statment. I have found nothing in the audit table.
1) Set "audit_trial" = true in teh init.ora file
2) Run the $ORACLE_HOME/rdbms/admin/cataudit.sql
3) Connect sys/password by sysdba and issue the following command:
- AUDIT SELECT TABLE, UPDATE TABLE, INSERT TABLE, DELETE TABLE BY APPS BY ACCESS;
Do I need to re-set the database after step 1? or I have made some wrong.
Thanks.

Problem with the XI-Audit log entries in the table "XI_AF_MSG_AUDIT"

Hi,
I have an async-szenarios for PO:
We send Idoc's from SAP ERP to a WebService via SOAP. And we take Ack's. We use Integrationsprocess with deadline block to catche the errors after the retrying (three times) and to send they via e-mail.
Our problem is, the number of the audit logs in the table "XI_AF_MSG_AUDIT":
In the RTW only we see one audit log (with three retries) in an error case. But in the table XI_AF_MSG_AUDIT there are about 76 entries for the same audit log in the error case and about 20 entries in the case of the succuessfull processing.
This number of the entries in the table causes problem with the size of the redo log file and delete job of cours the large size of the table and therefore problem on the data base. The table can not be controlled. The delete job can not run and cancels every time due this redo log problems
What can cause that?
How can it be prevented, that so much entries are not be made in the table "XI_AF_MSG_AUDIT".
Best regards
Gueltekin

Hi Gueltekin,
I am only aware of the general property auditLogEnabled of J2EE Engine Service SAP XI AF Core, which controls in general (default = true) that entries in the AF Message Audit log are written at all.
(see [http://help.sap.com/saphelp_nw70/helpdata/en/5c/22ee41c334c717e10000000a155106/frameset.htm|http://help.sap.com/saphelp_nw70/helpdata/en/5c/22ee41c334c717e10000000a155106/frameset.htm])
I assume that your scenarios in the error case is sending up to three messages and for each message the number of audit log infos are created. You might want to check the detailed entries in the log and see from where they are comming, you might use customer modules etc. as well.
Best regards,
Silvia

Audit logs for tables

Dear all,
I have a requirement of implementing audit logs for tables to insert,update,delete operations. Is there any way to achieve this since triggers are present only for insert,update and delete ?
I am using database 9.2.0.3.
thanks in advance.

Hi,
After I turn on audit trail on the database sever and issue DML statment. I have found nothing in the audit table.
1) Set "audit_trial" = true in teh init.ora file
2) Run the $ORACLE_HOME/rdbms/admin/cataudit.sql
3) Connect sys/password by sysdba and issue the following command:
- AUDIT SELECT TABLE, UPDATE TABLE, INSERT TABLE, DELETE TABLE BY APPS BY ACCESS;
Do I need to re-set the database after step 1? or I have made some wrong.
Thanks.

Audit logs for read operation on tables

I have a requirement of implementing audit logs for tables on read / select operation in addition to insert,update,delete operations. Is there any way to achieve this since triggers are present only for insert,update and delete ?
thanks in advance

Hi,
yes there are many ways you can audit the Source database according to your requirments. as you need to audit the select , insert etc you can audit in many ways
1) By implementing policies , (i.e) FGA , or statement policy on a given table or a given user.
2) you can also do the required task by implementing the alerts on specific conditions like select on a specifc table etc
you can use these utileties from AV console.
Regards.

Write to audit log from Axis Handler

Hi guys,
Using PI 7.11 SP 04 I have deployed the com.sap.aii.af.axisproviderlib.sda containing the libraries for Axis.
This is deployed fine and I can write my Handlers without trouble.
There is only 1 issue bugging me and that is the writing to the Adapter Audit Log. In SAP Note 1039369 FAQ XI Axis Adapter it is described how to write to the Audit log.
I can successfully write to the Channel monitor. But when I try to write to the Audit log data is still just written to the Channel monitor and not the audit log.
So what I have done is:
StatusAgent sa = (StatusAgent) getOption(Constants.MONITOR_AGENT_KEY);
Hashtable ht = getOptions();
ht.put("audit", Boolean.TRUE);
ht.put("pivoted", Boolean.TRUE);
sa.reportEvent(Status.OK, "This should be written to audit log but is written to channel monitor", ht);
sa.reportEvent(Status.ERROR, "This should also be written to audit log but is written to channel monitor", ht);
If i print the content of my hashtable in the channel monitor I can see that my entries are put into the table just fine. The 'audit' entry just seems to be completely ignored.
Anyone have and suggestions?
Regards,
Daniel

Hi Guys,
I need to know what JAR file i need to download for the following packages from SAP PI.
import com.sap.aii.axis.monitor.Status;
import com.sap.aii.axis.monitor.StatusAgent;
import com.sap.aii.axis.utils.Constants;
I am doing AXIS custom modules and i need to write to the PI 7.1 Audit Logs.
Thanks in advance.
Raj

"logon time" between USR41 and security audit log

Dear colleagues,
I got a following question from customer for security audit reason.
> 'Logon date' and 'Logon time' values stored in table USR41 are exactly same as
> logon history of Security Audit Log(Tr-cd:SM20)?
Table:USR41 saves 'logon date' and 'logon time' when user logs on to SAP System from SAP GUI.
And the Security Audit Log(Tr-cd:SM20) can save user's logon history;
at the time when user logged on, the security audit log is recorded .
I tried to check SAP GUI logon program:SAPMSYST several ways, however,
I could not check it because the program is protected even for read access.
I want to know about specification of "logon time" between USR41 and security audit log,
or about how to look into the program:SAPMSYST and debug it.
Thank you.
Best Regards.

Hi,
If you configure Security Audit you can achieve your goals...
1-Audit the employees how access the screens, tables, data...etc
Answer : Option 1 & 3
2-Audit all changes by all users to the data
Answer : Option 1 & 3
3-Keep the data up to one month
Answer: No such settings, but you can define maximum log size.
4-Log retention period can be defined.
Answer: No !.. but you can define maximum log size.
SM19/SM20 Options:
1-Dialog logon
You can check how many users logged in and at what time
2-RFC login/call
Same as above you can check RFC logins
3-Transaction/report start
You can see which report or transaction are executed and at what time
(It will help you to analyise unauthorized data change. Transactions/report can give you an idea, what data has been changed. So you can see who changed the data)
4-User master change
(You can see user master changes log with this option)
5-System/Other events
(System error can be logged using this option)
Hope, it clear the things...
Regards.
Rajesh Narkhede

SQLException in the audit log for the Message Display Tool

Hi
I´m newbie in PI Technology, and i have some issues when i try to do the next.
This is the scenario:
I need to communicate two systems, for one side i have SAP, and for the other side i have ADI (legal system) so, i use PI to do this (the communication), PI receive the data from SAP by means abap proxy, until this everything is correct, then i do the mapping of the data and i send a message to ADI (with the SAP XI Runtime Workbench) by means JDBC adapter, if i check the sended message with "Message Display Tool" show that the message was sent (status "Delivered") but if i check the received messages option, in the audit log displays the five next errors:
Error: Could not execute statement for table/stored proc. "FADIA4" (structure "StatementFADIA4") due to java.sql.SQLException: FADIA4 in FILEMET not valid for operation.
Error: JDBC Message processing failed, due to Error processing request in sax parser: Error when executing statement for table/stored proc. 'FADIA4' (structure 'StatementFADIA4'): java.sql.SQLException: FADIA4 in FILEMET not valid for operation.
Error: MP: exception caught with cause com.sap.engine.interfaces.messaging.api.exception.MessagingException: Error processing request in sax parser: Error when executing statement for table/stored proc. 'FADIA4' (structure 'StatementFADIA4'): java.sql.SQLException: FADIA4 in FILEMET not valid for operation.
Error: Adapter Framework caught exception: null
Error: Delivering the message to the application using connection JDBC_http://sap.com/xi/XI/System failed, due to: com.sap.engine.interfaces.messaging.api.exception.MessagingException: Error processing request in sax parser: Error when executing statement for table/stored proc. 'FADIA4' (structure 'StatementFADIA4'): java.sql.SQLException: FADIA4 in FILEMET not valid for operation..
if there are somebody that maybe could know what is the problem?, could the problem be the side of the legal system?, because inside of PI when i do the Test Configuration in the Integration Directory, the end of the test is successful.
Any comment is well received!!
Thanks,
Vicman
P.D. sometimes the error is: java.sql.SQLException: Token ) was not valid. Valid tokens: DAY PATH YEAR LABEL MONTH OPTION RESULT CONNECTION TRANSACTION.
what does it means?

Hi Pooja,
thanks for you quickly response!
XML sended:
<?xml version="1.0" encoding="UTF-8"?>
<ns0:MT_PgDocVentaECC_req xmlns:ns0="http://gmodelo.com/ECC/enviarCobranza">
   <DT_DatosDeControl>
      <MIDDLEWARE_ID/>
      <QUICK_ID/>
      <INTERFACE_NAME/>
      <MESSAGE_ID/>
      <LOG_ID/>
      <USER_ID/>
      <SOURCE_SYSTEM/>
      <TARGET_SYSTEM/>
   </DT_DatosDeControl>
   <DT_PagoDocVentaECC>
      <VKORG>TVKO</VKORG>
      <VKBUR>TVBUR</VKBUR>
      <VKBUR1>TVBUR</VKBUR1>
      <ROUTE>TVRO</ROUTE>
      <ROUTE1>TVRO</ROUTE1>
      <BLART>Q</BLART>
      <BELNR>100</BELNR>
      <WRBTR>200</WRBTR>
      <LFART>100</LFART>
      <VBELN>100</VBELN>
   </DT_PagoDocVentaECC>
</ns0:MT_PgDocVentaECC_req>
this is the XML received:
<?xml version="1.0" encoding="UTF-8"?>
<ns1:MT_PgDocVentaADI_req xmlns:ns1="http://gmodelo.com/ADI/recibirCobranza">
<StatementFADIA7>
<FADIA7action="INSERT">
<Table>FADIA7</Table>
<Access>
<NUMCIA>123</NUMCIA>
<NUMALM>234</NUMALM>
<SUBALM>300</SUBALM>
<CVETOP>16</CVETOP>
<FOLOPV>22</FOLOPV>
<SECOVA></SECOVA>
<IMPOVA>200</IMPOVA>
<ALMOVA>5678</ALMOVA>
<SUBOVA>21</SUBOVA>
<TOPOVA>21</TOPOVA>
<FOPOVA>41</FOPOVA>
<FECOVA>100</FECOVA>
<STSOVA> </STSOVA>
</Access>
</FADIA7></StatementFADIA7>
</ns1:MT_PgDocVentaADI_req>
what do you think about it?, anything wrong?

Audit log capacity

As auditing can be enabled and it keeps the audit logs. Is there a setting for audit retention configuration as well as size configuration. Also how uch space it occupied with average audit capabilities and how much is the growth.
This topic not much covered in docs. So I want to know from you guys as you must be having enough experience. Is there a criteria which can be used to plan database. Does it go to a seperate database table?
Any pointers can also be helpful.

The job 'Trims audit trail entries from site collections.'
It runs by defualt every month, which means you need to adjust the schedule so that it runs weekly so that it'll pick up your accelerated audit rules.
This is the job that exports the data to Excel and cleans up the entries from the database.

Audit Log Not Being Created

Hi,
I'm using the workflow application "Audit" as an activity in my custom workflow and I'm passing the required arguments.
In the workflow trace file, I can see that the Audit application is run using the passed parameters but no record is being created matching that information in the "log" table.
Any ideas/suggestions?
Thanks
Here is the trace for your information:
Resolved reference requesterWSUser = object
Assigning requesterFullName = Test1 Manager1
Action Set Audit Resources List
Result title set to 'Set Audit Resources List'
Evaluating XPRESS
Resolved reference approved = false
Resolved reference auditApps = [AD_Simulated]
Resolved reference auditApps = [AD_Simulated]
Assigning depApps = [AD_Simulated]
Action Audit
Result title set to 'Audit'
Iterating over depApps = [AD_Simulated]
Iteration 0
app = AD_Simulated
Argument op = audit
Argument type = User
Argument status = success
Argument action = View
Argument reason = User Access Recertification
Argument subject = TestManager1
Resolved reference user.waveset.organization = null
Resolved reference app = AD_Simulated
Resolved reference app = AD_Simulated
Argument resource = AD_Simulated
Resolved reference enduserId = testuser4
Argument accountId = testuser4
Resolved reference enduserView.accounts[Lighthouse].firstname = Test4
Resolved reference enduserView.accounts[Lighthouse].lastname = User4
Resolved reference enduserId = testuser4
Resolved reference requesterFullName = Test1 Manager1
Argument error = The access of the user Test4 User4(testuser4) has been recertified by Test1 Manager1
Calling application 'com.waveset.session.WorkflowServices'
Application requested argument op
Application requested argument logResultErrors
Application requested argument action
Application requested argument status
Application requested argument type
Application requested argument subject
Application requested argument name
Application requested argument resource
Application requested argument accountId
Application requested argument error
Application requested argument parameters
Application requested argument attributes
Application requested argument originalAttributes
Application requested argument overflowAttributes
Application requested argument auditableAttributesList
Application requested argument organizations
Step complete 'Audit'
Step inactive 'Display Message'
-------------------------------------------------------------------------

I agree with the anokun7. Check to make sure the action your are giving it is a valid one. ( See IDM Workflow Forms and Views pdf and search for Action Names, it will give you a list of all the valid actions) Also you can add your own attributes to the Audit object as well using the attributes variable. ( It expects a map: <map>
<s>Key</s>
<ref>value</ref>
<map>
Value can be a reference, or string, or however complex you want to make it. Just be aware of what view (if any) is available at the time you call the audit. Hope this helps
Message was edited by:
dmac28
Oh yeah..The attributes will appear on the audit log reports, Based on what action and type you audited it will show up on that record. i.e Delete action, on Type User...that audit record will have a changes value which will have whatever attributes you passed to the audit object.

Audit Log query

I am trying to figure out why a query of the OID audit logs is taking so long....
the search filter is:
(&(orcleventtime>=20070426)(orcleventtime<=20070427)(orcleventtype=User login))
it takes 97 seconds to return 1622 entries.
when i run a query with this filter....
(&(orcleventtime>=20070426)(orcleventtype=User login))
it takes 0.2 seconds
any ideas?

Purging an AUD$ table is good idea after taking the export....
Yeah...that could be better idea to audit those things that application skips...
I was just getting calls from finance and operations departments... complaining that their ERP applications were haning taking long time to execute day end procedures and in reports...around 20 to 30 minutes.... as I recalled that my last deployment on live was enabling of auditing as I executed noaudit all and noaudit select, update, delete, insert on erp, The user got their day end procedures executed and report in less than 1 minute...
Can anybody explain me....Does auditing degrades performance..?
Regards?

Audit log is not showing any data GRC 10 PC

Hi,
when we are trying to execute the audit logs
under reports in process controls,not showing data and getting
error like no data matching the entere selec criteria.
do we need any configuration changes required
Thanks
GRC Admin

Hello,
check the table DBTABLOG if data contains or not,if no data then maintain the parameter rec/client in RZ11 and try the same
while executing the audit log need to maintain the time frame as HH:MM not HH:MM:SS
check the below link about DBTABLOG
Change Log Monitor Enabling by Table log Activation in SAP Production Environment - Governance, Risk and Compliance - SC…
Regards
Baithi

Audit log viewer

Hi to all
I'm newbie to SQL Server.
I'm trying to configure the server (Enterprise ver. 11) to track change regarding insert/update/delete of records inside a simple single table.
I dont know exactly what and how the audit features of SQL Server write and track, but I need a table where I can read the changes on some table or some field of that tables.
I made some empirical temptatives.
I created the Audit Server (on Security of database instance). Then I created the "Server Audit Specification"...where I specified UPDATE as type, OBJECT...my table, and entity... my user that connect to database (For this temptative I'm using
a Access database linked/connected by ODBC. Work good because I see the changes made in Access, inside the SQL Management Studio).
than I activated the Audit Server... then activated Audit Specification (on my database schema).
I made some change on table... but I see empty the View Log Viewer.
I try to configure the audit server as file or as application. I don't know if the problem is there.
Could someone give me some basic/dummie suggestion?
thank you.
Daniele.b75

Hi,
Alternately, you can create a trigger to audit the table and then write certain information to another table. Here is a sample code.
create table demo
( c1 varchar(50)),
c2 varchar(50)),
go
create table audit_demo
old_c1 varchar(50)),
old_c2 varchar(50)),
audit_UserID varchar(50)),
audit_Timestamp datetime,
audit_action varchar(50))
go
create TRIGGER updDemo
ON demo
for UPDATE
as
if(UPDATE(c2))
begin
INSERT INTO audit_demo
(old_c1,
old_c2,
audit_UserID,
audit_Timestamp,
audit_action)
SELECT c1,c2,SUSER_SNAME(),GETDATE(),'update'
FROM deleted
end
insert into demo values('a','p')
insert into demo values('b','p')
insert into demo values('c','p')
insert into demo values('d','p')
demo for update trigger
select * from demo
select * from audit_demo
update demo set c2='ppp' where c1='b'
go
select * from demo
select * from audit_demo
Thanks.
Tracy Cai
TechNet Community Support

Audit Log Trimming Timer Job stuck at "pausing" status

Hi,
We have a SharePoint 2010 farm and our Audit table is growing rapidly. I checked our "Audit log Trimming" timer job and it has been stuck at "pausing" status for more than a month. Any advice to resolve this issue would be great.
Thanks,
norasampang

Hi Trevor,
Do you think the reason that the time job is failing is because the audit log table is big and the audit timer jod times out. I saw your reply here at this
post
where you have mentioned "
It may be timing out. Have you executed it manually to see if it runs without errors?
Can you please explain in more detail what you meant by that. I was thinking of trying to trim the Audit log using this script in small batch. Can you please let me know if this script seems right?
$site = Get-SPSite -Identity http://sharepointsite.com
$date = Get-Date
$date = $date.AddDays(-1021)
$site.Audit.DeleteEntries($date)
At first i would like to delete all datas that are older than 1021 days old and eventually get rid of the other logs in smaller chunks. Any advice and suggestion would be highly appreciated.
Thanks,
norasampang

Audit Log - Table Log

Similar Messages

Maybe you are looking for