Capture Audit log

Can any one tell me how to capture Audit log in sap without enabling it i,e. not through sm20

My concern was without enabling audit log through sm19, and display by SM21. How can i find user activity in SAP? i.e, at what time user login/logout from sap and entered which t-code/report of sap and executed which table of sap?
more over i would like to know all these details like...track user activity from SAP i.e., date, time, terminal name, ip address and transaction code, program name and database table along with these details:
a.     PC identity, which is fixed and unique for each users' pc.
b.     VPN login - external and internal ip address of connecting pc.
c.     Report on users connecting to multiple SAP idu2019s from the same pc.
d.     For watched users, need to watch every single record that they access.
e.     Capturing users accessed to which database table of SAP.
Edited by: Ravipawar1 on Feb 9, 2011 4:28 PM

Similar Messages

Security audit log doesn't capture services

Hello I am posting this on behalf of Carol, Would you please be kind on helping her?
After the upgrade to ECC the t-codes for the ESS functions were
changed to services that run via the portal. We need to find where the
audit data is logged for these services. Below are some of the t-codes
which are now run via the new service name.
PZ02##sap.com/essusaddr/Per_Address_US
PZ03##sap.com/essusbank/Per_Bank_US
PZ10##sap.com/essusw4/Per_W4_US
PZ11_PDF#sap.com/ess~rem/PaySlip2
PZ18##Z_WDA_HR_EMRG_CONTACT
A search of notes with 'security audit log' hasn't turned up any new
information.
Carol

Hi Ricardo,
check the notes:
[544708|https://websmp130.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=544708] - Changed password rules prevent ITS-based logon
[872773|https://websmp230.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=872773] - Changed password rules and ITS-based logon
Alternatively use the search terms "ESS Scenario PZ02/ Personal data" .. you might get some related notes.
Regards,
Srihari

Attribute Encryption in the Audit log

All,
I am encrypting attributes so sensitive data is encyrpted at rest. Found out that the audit log doesn't encrypt these attributes. It encrypts userpassword, but not these. Is there a setting or configuration I can extend that will encrypt these attributes in the audit file?
And if there is, what happens if I need to expand the list of encrypted attributes.
I am currently running v 6.3.x, and in process of upgrading to ODSEE 11g.x
Frank

Hello,
as far as I can understand, I'm afraid that what you're trying to accomplish is not possible, since attribute encryption is something that happens 'within the Directory Server instance, between the protocol and the DB'... so the informations are sent in clear over the protocol, and this is what the audit log captures. According to the official product documentation:
http://docs.oracle.com/cd/E19261-01/820-2763/bcaeg/index.html
"Attribute encryption protects sensitive data while it is stored in the directory. Attribute encryption allows you to specify that certain attributes of an entry are stored in an encrypted format. This prevents data from being readable while stored in database files, backup files, and exported LDIF files.
With this feature, attribute values are encrypted before they are stored in the Directory Server database, and decrypted back to their original value before being returned to the client. You must use access controls to prevent clients from accessing such attributes without permission, and SSL to encrypt the attribute values when in transit between the client and Directory Server."
HTH,
Marco

Report RPUAUD00 Infotype audit log with date & time

Hi all,
I want to know from where the time is captured when we execute Report RPUAUD00 Infotype audit log?
I want to know from which fields or tables or structures?
We want to use the same logic in a custom report.
Your help appreciated.
Thanks & regards,
Vikas

Hi,
Infotype logs are maintained in PCL4 cluster. You can use fn modules HR_INFOTYPE_LOG_GET_LIST
and HR_INFOTYPE_LOG_GET_DETAIL to get infotype logs.
Thanks,
Aravind

Each Document in Audit Log entry

Hi,
There is document library of name testdoclib in the site.
There are three files under the document library with names file1,.file2 and file3.
Users are downloading/viewing only file1,file2 files alone.
Now in the audit log entries,will i be able to view file3 entry as well?
In the audit log,will the entries be of files which are viewed/downloaded by the users?
Please share inputs on the same.
Regards,
Sudheer
Thanks & Regards, Sudheer

Hi Sudheer,
The log entries are captured for viewing, downloading or opening the document only or checked out or check-in. In your scenario, file3 entry will not be there until and unless any of the above mentioned actions happened.
Please refer to the following article.
https://support.office.microsoft.com/en-us/article/View-audit-log-reports-4293e8d5-4e7d-4201-b8ac-c8e63a100131?CorrelationId=d11e5086-013b-4416-a066-df51f22ff6fe&ui=en-US&rs=en-US&ad=US
Please don't forget to mark it as answered, if your problem resolved or helpful.

SharePoint 2013 audit log unexpected error

In one of my SharePoint 2013 site collection, when i try to save a audit log, i get unexpected error. It worked fine before last week and no any special setting has been applied before the issue appeared. The issue doesn't appear in other site collection.
i have tried to reproduce the issue with farm admin account and site collection admin, no success for all these accounts. However, i can see access denied error in the ULS log although i think the permission is not the problem. You may check the ULS log below.
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xC33B005
2jtj Assert
ShipAssert location: (0) condition: StackTrace: at onetnative.dll: (sig=7b7c0170-6822-4da2-8b1b-70510b777a4a|2|onetnative.pdb, offset=12700) at onetnative.dll: (offset=125F1)
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
Unified Logging Service c91s
Monitorable Watson bucket parameters: Microsoft SharePoint Foundation 4, ULSShipAssert12, 2jtj, 15.0.4481.0
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D00B
2jtk High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D00B
2jtq High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D005
2jx8 High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D005
5s03 High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D005
5s02 High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.41 w3wp.exe (0x77C0)
0x2918 0xEB2D005
2jw0 High
Metro library failure (0x80070005): ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.43 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
Database ahjqp
High [Forced due to logging gap, cached @ 06/19/2014 10:48:07.68, Original Level: Verbose] SQL connection time: 0.064296296654057
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.43 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
General 8nca
Medium Application error when access /_layouts/15/CustomizeReport.aspx, Error=拒绝访问。 (异常来自 HRESULT:0x80030005 (STG_E_ACCESSDENIED)) 在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
errorCode, IntPtr errorInfo) 在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb) 在 System.IO.BufferedStream.FlushWrite() 在 System.IO.StreamWriter.Dispose(Boolean disposing)
在 System.IO.StreamWriter.Close() 在 System.Xml.XmlTextWriter.Close() 在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose() 在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator) 在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object
sender, EventArgs e) 在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) 在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.44 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
Runtime tkau
Unexpected System.Runtime.InteropServices.COMException: 拒绝访问。 (异常来自 HRESULT:0x80030005 (STG_E_ACCESSDENIED)) 在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr
errorInfo) 在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb) 在 System.IO.BufferedStream.FlushWrite() 在 System.IO.StreamWriter.Dispose(Boolean disposing) 在
System.IO.StreamWriter.Close() 在 System.Xml.XmlTextWriter.Close() 在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose() 在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator) 在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object
sender, EventArgs e) 在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) 在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
ea429c9c-4288-00dd-4f6f-d2bb079f3d44
06/19/2014 10:48:09.44 w3wp.exe (0x77C0)
0x2918 SharePoint Foundation
General ajlz0
High Getting Error Message for Exception System.Web.HttpUnhandledException (0x80004005): 引发类型为“System.Web.HttpUnhandledException”的异常。 ---> System.Runtime.InteropServices.COMException (0x80030005): 拒绝访问。 (异常来自 HRESULT:0x80030005
(STG_E_ACCESSDENIED)) 在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo) 在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb)
在 System.IO.BufferedStream.FlushWrite() 在 System.IO.StreamWriter.Dispose(Boolean disposing) 在 System.IO.StreamWriter.Close() 在 System.Xml.XmlTextWriter.Close() 在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose() 在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator)
在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object sender, EventArgs e) 在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) 在 System.Web.UI.Page.ProcessRequestMain(Boolean
includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) 在 System.Web.UI.Page.HandleError(Exception e) 在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
在 System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) 在 System.Web.UI.Page.ProcessRequest() 在 System.Web.UI.Page.ProcessRequest(HttpContext context)
在 System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() 在 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
ea429c9c-4288-00dd-4f6f-d2bb079f3d44

i have added the account to the local admin group of SQL Server and SharePoint Server. the issue remains. it is the system admin of the SQL server.
Logging Correlation Data
Medium
Name=Request (POST:https://xxx/_layouts/15/CustomizeReport.aspx?ReportId=df9e0f20-f356-4115-9286-ac6eecbc03ce&Category=Auditing)
Authentication Authorization
Medium
Non-OAuth request. IsAuthenticated=True, UserIdentityName=0#.w|tlw\farmadmin, ClaimsCount=28
Logging Correlation Data
Medium
Site=/
Information Rights Management
Medium
Information Rights Management (IRM): Requesting user is System account.
Files
High
UserAgent not available, file operations may not be optimized.    在 Microsoft.SharePoint.SPFileStreamManager.CreateCobaltStreamContainer(SPFileStreamStore spfs, ILockBytes ilb, Boolean copyOnFirstWrite, Boolean
disposeIlb)     在 Microsoft.SharePoint.SPFileStreamManager.SetInputLockBytes(SPFileInfo& fileInfo, SqlSession session, PrefetchResult prefetchResult)     在 Microsoft.SharePoint.CoordinatedStreamBuffer.SPCoordinatedStreamBufferFactory.CreateFromDocumentRowset(Guid
databaseId, SqlSession session, SPFileStreamManager spfstm, Object[] metadataRow, SPRowset contentRowset, SPDocumentBindRequest& dbreq, SPDocumentBindResults& dbres)     在 Microsoft.SharePoint.SPSqlClient.GetDocumentContentRow(Int32
rowOrd, Object ospFileStmMgr, SPDocumentBindRequest& dbreq, SPDocumentBindResults& dbres)     在 Microsoft.SharePoint.Library.SPRequestInternalClass.GetFileAndMetaInfo(String bstrUrl, Byte bPageView, Byte bPageMode, Byte bGetBuildDependencySet,
String bstrCurrentFolderUrl, Int32 iRequestVersion, Byte bMainFileRequest, Boolean& pbCanCustomizePages, Boolean& pbCanPersonalizeWebParts, Boolean& pbCanAddDeleteWebParts, Boolean& pbGhostedDocument, Boolean& pbDefaultToPersonal, Boolean&
pbIsWebWelcomePage, String& pbstrSiteRoot, Guid& pgSiteId, UInt32& pdwVersion, String& pbstrTimeLastModified, String& pbstrContent, UInt32& pdwPartCount, Object& pvarMetaData, Object& pvarMultipleMeetingDoclibRootFolders, String&
pbstrRedirectUrl, Boolean& pbObjectIsList, Guid& pgListId, UInt32& pdwItemId, Int64& pllListFlags, Boolean& pbAccessDenied, Guid& pgDocid, Byte& piLevel, UInt64& ppermMask, Object& pvarBuildDependencySet, UInt32& pdwNumBuildDependencies,
Object& pvarBuildDependencies, String& pbstrFolderUrl, String& pbstrContentTypeOrder, Guid& pgDocScopeId)     在 Microsoft.SharePoint.Library.SPRequestInternalClass.GetFileAndMetaInfo(String bstrUrl, Byte bPageView, Byte
bPageMode, Byte bGetBuildDependencySet, String bstrCurrentFolderUrl, Int32 iRequestVersion, Byte bMainFileRequest, Boolean& pbCanCustomizePages, Boolean& pbCanPersonalizeWebParts, Boolean& pbCanAddDeleteWebParts, Boolean& pbGhostedDocument,
Boolean& pbDefaultToPersonal, Boolean& pbIsWebWelcomePage, String& pbstrSiteRoot, Guid& pgSiteId, UInt32& pdwVersion, String& pbstrTimeLastModified, String& pbstrContent, UInt32& pdwPartCount, Object& pvarMetaData, Object&
pvarMultipleMeetingDoclibRootFolders, String& pbstrRedirectUrl, Boolean& pbObjectIsList, Guid& pgListId, UInt32& pdwItemId, Int64& pllListFlags, Boolean& pbAccessDenied, Guid& pgDocid, Byte& piLevel, UInt64& ppermMask, Object&
pvarBuildDependencySet, UInt32& pdwNumBuildDependencies, Object& pvarBuildDependencies, String& pbstrFolderUrl, String& pbstrContentTypeOrder, Guid& pgDocScopeId)     在 Microsoft.SharePoint.Library.SPRequest.GetFileAndMetaInfo(String
bstrUrl, Byte bPageView, Byte bPageMode, Byte bGetBuildDependencySet, String bstrCurrentFolderUrl, Int32 iRequestVersion, Byte bMainFileRequest, Boolean& pbCanCustomizePages, Boolean& pbCanPersonalizeWebParts, Boolean& pbCanAddDeleteWebParts, Boolean&
pbGhostedDocument, Boolean& pbDefaultToPersonal, Boolean& pbIsWebWelcomePage, String& pbstrSiteRoot, Guid& pgSiteId, UInt32& pdwVersion, String& pbstrTimeLastModified, String& pbstrContent, UInt32& pdwPartCount, Object&
pvarMetaData, Object& pvarMultipleMeetingDoclibRootFolders, String& pbstrRedirectUrl, Boolean& pbObjectIsList, Guid& pgListId, UInt32& pdwItemId, Int64& pllListFlags, Boolean& pbAccessDenied, Guid& pgDocid, Byte& piLevel,
UInt64& ppermMask, Object& pvarBuildDependencySet, UInt32& pdwNumBuildDependencies, Object& pvarBuildDependencies, String& pbstrFolderUrl, String& pbstrContentTypeOrder, Guid& pgDocScopeId)     在 Microsoft.SharePoint.SPWeb.GetWebPartPageContent(Uri
pageUrl, Int32 pageVersion, PageView requestedView, HttpContext context, Boolean forRender, Boolean includeHidden, Boolean mainFileRequest, Boolean fetchDependencyInformation, Boolean& ghostedPage, String& siteRoot, Guid& siteId, Int64& bytes,
Guid& docId, UInt32& docVersion, String& timeLastModified, Byte& level, Object& buildDependencySetData, UInt32& dependencyCount, Object& buildDependencies, SPWebPartCollectionInitialState& initialState, Object& oMultipleMeetingDoclibRootFolders,
String& redirectUrl, Boolean& ObjectIsList, Guid& listId)     在 Microsoft.SharePoint.ApplicationRuntime.SPRequestModuleData.FetchWebPartPageInformationForInit(HttpContext context, SPWeb spweb, Boolean mainFileRequest, String
path, Boolean impersonate, Boolean& isAppWeb, Boolean& fGhostedPage, Guid& docId, UInt32& docVersion, String& timeLastModified, SPFileLevel& spLevel, String& masterPageUrl, String& customMasterPageUrl, String& webUrl, String&
siteUrl, Guid& siteId, Object& buildDependencySetData, SPWebPartCollectionInitialState& initialState, String& siteRoot, String& redirectUrl, Object& oMultipleMeetingDoclibRootFolders, Boolean& objectIsList, Guid& listId, Int64&
bytes)     在 Microsoft.SharePoint.ApplicationRuntime.SPRequestModuleData.GetWebPartPageData(HttpContext context, String path, Boolean throwIfFileNotFound)     在 Microsoft.SharePoint.ApplicationRuntime.SPVirtualPathProvider.GetCacheKey(String
virtualPath)     在 System.Web.Compilation.BuildManager.GetVPathBuildResultFromCacheInternal(VirtualPath virtualPath, Boolean ensureIsUpToDate)     在 System.Web.Compilation.BuildManager.GetVPathBuildResultInternal(VirtualPath
virtualPath, Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean throwIfNotFound, Boolean ensureIsUpToDate)     在 System.Web.Compilation.BuildManager.GetVPathBuildResultWithNoAssert(HttpContext context, VirtualPath
virtualPath, Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean throwIfNotFound, Boolean ensureIsUpToDate)     在 System.Web.Compilation.BuildManager.GetVPathBuildResult(HttpContext context, VirtualPath virtualPath,
Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean ensureIsUpToDate)     在 System.Web.UI.MasterPage.CreateMaster(TemplateControl owner, HttpContext context, VirtualPath masterPageFile, IDictionary contentTemplateCollection)
在 System.Web.UI.Page.ApplyMasterPage()     在 System.Web.UI.Page.PerformPreInit()     在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
在 System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)     在 System.Web.UI.Page.ProcessRequest()     在 System.Web.UI.Page.ProcessRequest(HttpContext context)
在 System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()     在 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)     在 System.Web.HttpApplication.PipelineStepManager.ResumeSteps(Exception
error)     在 System.Web.HttpApplication.BeginProcessRequestNotification(HttpContext context, AsyncCallback cb)     在 System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context)
在 System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)     在 System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer,
IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)     在 System.Web.Hosting.UnsafeIISMethods.MgdIndicateCompletion(IntPtr pHandler, RequestNotificationStatus& notificationStatus)     在 System.Web.Hosting.UnsafeIISMethods.MgdIndicateCompletion(IntPtr
pHandler, RequestNotificationStatus& notificationStatus)     在 System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)
在 System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)
Files
Medium
Spent 0 ms to bind 29783 byte file stream
Monitoring
High
Leaving Monitored Scope (GetFileAndMetaInfo). 执行时间=17.6751425083646
Monitoring
High
Leaving Monitored Scope (GetWebPartPageContent). 执行时间=17.8435806939653
OpenXml
Medium
OfficePackageLibrary::OpenPackage(app=3, path=C:\Users\FarmAdmin\AppData\Local\Temp\tmpBFE2.tmp, fcm=3)
Database
High
[Forced due to logging gap, Original Level: VerboseEx] Reverting to process identity
Database
High
[Forced due to logging gap, cached @ 06/20/2014 14:36:33.08, Original Level: Verbose] SQL connection time: 0.0727483919888626
Database
High
[Forced due to logging gap, Original Level: VerboseEx] Reverting to process identity
Database
High
[Forced due to logging gap, cached @ 06/20/2014 14:36:35.00, Original Level: Verbose] SQL connection time: 0.07969118458531
Database
High
[Forced due to logging gap, Original Level: VerboseEx] Reverting to process identity
0xC33B005
Assert
ShipAssert location: (0) condition:   StackTrace: at onetnative.dll: (sig=7b7c0170-6822-4da2-8b1b-70510b777a4a|2|onetnative.pdb, offset=12700) at onetnative.dll: (offset=125F1)
Unified Logging Service
Monitorable
Watson bucket parameters: Microsoft SharePoint Foundation 4, ULSShipAssert12, 2jtj, 15.0.4481.0
0xEB2D00B
High
Metro library failure (0x80070005):
0xEB2D00B
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xC33B005
Assert
ShipAssert location: (0) condition:   StackTrace: at onetnative.dll: (sig=7b7c0170-6822-4da2-8b1b-70510b777a4a|2|onetnative.pdb, offset=12700) at onetnative.dll: (offset=125F1)
Unified Logging Service
Monitorable
Watson bucket parameters: Microsoft SharePoint Foundation 4, ULSShipAssert12, 2jtj, 15.0.4481.0
0xEB2D00B
High
Metro library failure (0x80070005):
0xEB2D00B
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
0xEB2D005
High
Metro library failure (0x80070005):
Database
High
[Forced due to logging gap, cached @ 06/20/2014 14:36:36.86, Original Level: Verbose] SQL connection time: 0.0706353681551612
General
Medium
Application error when access /_layouts/15/CustomizeReport.aspx, Error=拒绝访问。 (异常来自 HRESULT:0x80030005 (STG_E_ACCESSDENIED))   在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo)     在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb)     在 System.IO.BufferedStream.FlushWrite()     在 System.IO.StreamWriter.Dispose(Boolean
disposing)     在 System.IO.StreamWriter.Close()     在 System.Xml.XmlTextWriter.Close()     在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose()     在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator)     在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object
sender, EventArgs e)     在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)     在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
Runtime
Unexpected
System.Runtime.InteropServices.COMException: 拒绝访问。 (异常来自 HRESULT:0x80030005 (STG_E_ACCESSDENIED))    在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb)     在 System.IO.BufferedStream.FlushWrite()     在 System.IO.StreamWriter.Dispose(Boolean disposing)
在 System.IO.StreamWriter.Close()     在 System.Xml.XmlTextWriter.Close()     在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose()     在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()
在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator)     在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object
sender, EventArgs e)     在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)     在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
General
High
Getting Error Message for Exception System.Web.HttpUnhandledException (0x80004005): 引发类型为“System.Web.HttpUnhandledException”的异常。 ---> System.Runtime.InteropServices.COMException (0x80030005): 拒绝访问。 (异常来自 HRESULT:0x80030005
(STG_E_ACCESSDENIED))     在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)     在 Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset,
Int32 cb)     在 System.IO.BufferedStream.FlushWrite()     在 System.IO.StreamWriter.Dispose(Boolean disposing)     在 System.IO.StreamWriter.Close()     在 System.Xml.XmlTextWriter.Close()
在 Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.Dispose()     在 Microsoft.Office.RecordsManagement.Reporting.ReportData.Dispose()     在 Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable
query, SPFolder folder, ReportNameGenerator reportNameGenerator)     在 Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object sender, EventArgs e)     在 System.Web.UI.WebControls.Button.RaisePostBackEvent(String
eventArgument)     在 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)     在 System.Web.UI.Page.HandleError(Exception e)     在 System.Web.UI.Page.ProcessRequestMain(Boolean
includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)     在 System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)     在 System.Web.UI.Page.ProcessRequest()
在 System.Web.UI.Page.ProcessRequest(HttpContext context)     在 System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()     在 System.Web.HttpApplication.ExecuteStep(IExecutionStep
step, Boolean& completedSynchronously)

Audit Log Report not display and error is "Report Contents No data"

Dear All,
i have reuired the audit log report but when i am click the Site Action->Site Setting->Audit log reports->Run a custom report-> select the day and option and click ok the i have received the error
Please help me please check below screen shot

Can you please confirm that you have configured events to audit?
Configure
audit settings for a site collection
Here is step by step how to configure audit setting.
http://anthony-verschraegen.blogspot.ca/2013/04/sharepoint-2013-configuring-audit.html
Amit

Issue with Audit Log report in SharePoint 2010

I have enabled REPORTING feature at site collection level and configured the site collection audit settings. I tried to generated Audit log reports, most of the time it keeps on processing as shown in fig.It
keeps on processing, never comes to report generated successful message. how to overcome this issue?

i'm facing same issue, even when i tried to generate report for limited limited period(5 days) for a particular event(ex: delete or restore items (or) edit items).
I think, the below reference may guide you solve your issue
http://sharepoint.stackexchange.com/questions/17151/how-often-should-the-auditing-log-be-cleared-to-not-affect-performance
Sekar - Our life is short, so help others to grow
Whenever you see a reply and if you think is helpful, click "Vote As Helpful"! And whenever
you see a reply being an answer to the question of the thread, click "Mark As Answer

Not able to generate "Audit Log Tampering report"

Hi,
I am not able to generate the Audit Log tampering report in version 8.0 of Sun Identity Manager. I am encountering the following message when I am trying to generate the report.
"Tamper-resistant logging is disabled. Unable to verify the integrity of the audit logs." I did not find any option to set the tamper-resistant logging feature in version 8.0 of Sun Idm.
In version 6 there is an option to set the tamper resistant audit log box by "Enabling tamper-resistant audit logs box" ( Please refer: http://docs.sun.com/source/819-4483/auditing.html)
The generated report (in version 6) did not show any data inspite of me deleting a row in the audit log.
I hope you can help me with this problem. Thanks in advance
Regards,
Sharon

1) It shouldnt matter, but try
destype=file (FILE small case)
2) In builder, in property pallette see if you have given any "initial value" for these parameters (especially desname, destype etc) ?
3) Do not give "batch=yes" in command line and try
Thanks
Ratheesh

Write to audit log from Axis Handler

Hi guys,
Using PI 7.11 SP 04 I have deployed the com.sap.aii.af.axisproviderlib.sda containing the libraries for Axis.
This is deployed fine and I can write my Handlers without trouble.
There is only 1 issue bugging me and that is the writing to the Adapter Audit Log. In SAP Note 1039369 FAQ XI Axis Adapter it is described how to write to the Audit log.
I can successfully write to the Channel monitor. But when I try to write to the Audit log data is still just written to the Channel monitor and not the audit log.
So what I have done is:
StatusAgent sa = (StatusAgent) getOption(Constants.MONITOR_AGENT_KEY);
Hashtable ht = getOptions();
ht.put("audit", Boolean.TRUE);
ht.put("pivoted", Boolean.TRUE);
sa.reportEvent(Status.OK, "This should be written to audit log but is written to channel monitor", ht);
sa.reportEvent(Status.ERROR, "This should also be written to audit log but is written to channel monitor", ht);
If i print the content of my hashtable in the channel monitor I can see that my entries are put into the table just fine. The 'audit' entry just seems to be completely ignored.
Anyone have and suggestions?
Regards,
Daniel

Hi Guys,
I need to know what JAR file i need to download for the following packages from SAP PI.
import com.sap.aii.axis.monitor.Status;
import com.sap.aii.axis.monitor.StatusAgent;
import com.sap.aii.axis.utils.Constants;
I am doing AXIS custom modules and i need to write to the PI 7.1 Audit Logs.
Thanks in advance.
Raj

How to schedule a batch job to generate security audit log (SM20)

May be this is a repeat question for this forum. Apologize, if it is. Is there a way to schedule a batch job to generate security audit log (SM20) automatically and possibly send a message to SAP Inbox or generate a spool request? Release is 4.6C.
Regards
Nirmal

> May be this is a repeat question for this forum. Apologize, if it is.
You don't need to apologize. You only need to do a very simple search...
> Total Questions: 18 (16 unresolved)
Perhaps 16 of those 18 questions you have not followed up on could have been spared as well?
Please do the needfull.
Cheers,
Julius

"logon time" between USR41 and security audit log

Dear colleagues,
I got a following question from customer for security audit reason.
> 'Logon date' and 'Logon time' values stored in table USR41 are exactly same as
> logon history of Security Audit Log(Tr-cd:SM20)?
Table:USR41 saves 'logon date' and 'logon time' when user logs on to SAP System from SAP GUI.
And the Security Audit Log(Tr-cd:SM20) can save user's logon history;
at the time when user logged on, the security audit log is recorded .
I tried to check SAP GUI logon program:SAPMSYST several ways, however,
I could not check it because the program is protected even for read access.
I want to know about specification of "logon time" between USR41 and security audit log,
or about how to look into the program:SAPMSYST and debug it.
Thank you.
Best Regards.

Hi,
If you configure Security Audit you can achieve your goals...
1-Audit the employees how access the screens, tables, data...etc
Answer : Option 1 & 3
2-Audit all changes by all users to the data
Answer : Option 1 & 3
3-Keep the data up to one month
Answer: No such settings, but you can define maximum log size.
4-Log retention period can be defined.
Answer: No !.. but you can define maximum log size.
SM19/SM20 Options:
1-Dialog logon
You can check how many users logged in and at what time
2-RFC login/call
Same as above you can check RFC logins
3-Transaction/report start
You can see which report or transaction are executed and at what time
(It will help you to analyise unauthorized data change. Transactions/report can give you an idea, what data has been changed. So you can see who changed the data)
4-User master change
(You can see user master changes log with this option)
5-System/Other events
(System error can be logged using this option)
Hope, it clear the things...
Regards.
Rajesh Narkhede

Audit Log

Hi
We are doing a file-to-file scenario without content conversion. That means we did not set up any interfaces in the repository but created a so called u201CgenericInterfaceu201D in the Configuration. This leads to a scenario where the file will just be taken and dropped from and to a file server without any conversion.
We are facing know a problem in the Audit Log in the RWB. The file sender adapter shows the audit log until the file has been successfully taken. On the receiver adapter we will find exactly the same message number but no further audit log. It is not possible to navigate into the audit log on the receiver adapter. In the message monitor of the RWB the message will not be displayed.
We already checked the settings messaging.system.statusLog in the SAP XI AF Messaging service in the visual admin.
Does anybody know this problem?
Regards Oliver

Hi,
please refer this SAP Note 751915.
this may be help you.
regards,
bobby

SOAP error in audit log of message monitor

Hi,
I am using RPC wsdl file for idoc-xi-soap services. When I am doing the testing for the scenario in the message monitor I am getting the following audit log:
2008-02-29 15:21:48 Success Message successfully received by messaging system. Profile: XI URL: http://EMHBSSAP05.bekaertcorp.local:56600/MessagingSystem/receive/AFW/XI Credential (User): PIISUSER
2008-02-29 15:21:48 Success Using connection SOAP_http://sap.com/xi/XI/System. Trying to put the message into the receive queue.
2008-02-29 15:21:48 Success The message status set to DLNG.
2008-02-29 15:21:48 Success Delivering to channel: ZCC_Material_SOAP
2008-02-29 15:21:48 Success MP: Entering module processor
2008-02-29 15:21:48 Success MP: Processing local module localejbs/sap.com/com.sap.aii.af.soapadapter/XISOAPAdapterBean
2008-02-29 15:21:48 Success Message successfully put into the queue.
2008-02-29 15:21:48 Success The message was successfully retrieved from the receive queue.
2008-02-29 15:21:48 Success SOAP: request message entering the adapter with user J2EE_GUEST
2008-02-29 15:21:48 Success SOAP: completed the processing
2008-02-29 15:21:48 Success SOAP: continuing to response message a9ea9a30-e6d1-11dc-c8bd-001a4b0658c1
2008-02-29 15:21:48 Error SOAP: response message contains an error XIAdapter/PARSING/ADAPTER.SOAP_EXCEPTION - soap fault:
2008-02-29 15:21:48 Success SOAP: sending a delivery error ack ...
2008-02-29 15:21:48 Success SOAP: sent a delivery error ack
2008-02-29 15:21:48 Success Acknowledgement creation triggered for type: SystemErrorAck
2008-02-29 15:21:48 Error MP: Exception caught with cause com.sap.aii.af.ra.ms.api.RecoverableException: SOAP: response message contains an error XIAdapter/PARSING/ADAPTER.SOAP_EXCEPTION - soap fault:
2008-02-29 15:21:48 Success Acknowledgement creation triggered for type: AckNotSupported
2008-02-29 15:21:48 Error Exception caught by adapter framework: SOAP: response message contains an error XIAdapter/PARSING/ADAPTER.SOAP_EXCEPTION - soap fault:
2008-02-29 15:21:48 Error Delivery of the message to the application using connection SOAP_http://sap.com/xi/XI/System failed, due to: com.sap.aii.af.ra.ms.api.RecoverableException: SOAP: response message contains an error XIAdapter/PARSING/ADAPTER.SOAP_EXCEPTION - soap fault:.
2008-02-29 15:21:48 Success The message status set to WAIT.
Can anybody suggest what is the meaning and root cause for the error:
SOAP: response message contains an error XIAdapter/PARSING/ADAPTER.SOAP_EXCEPTION - soap fault:
Thanks & Regards
Prabhat

go to sxi_monitor and get the inbound message, later go to IR an do a TEST mapping.
any error occur?if yes, paste it here
generally soap fault o soap exception relate to an error from WS side,but before say nothing check you have all data and transformation OK.
hope it helps

500 Internal Server Error - Channel Monitoring Audit Log

Hi Experts,
We are facing an error in the 'Audit Log' of the communication channel monitoring of a File Sender Adapter.
The channel uses a custom written Java Module which uses XSLT parser internally. The audit log displays the following error:
500 Internal Server Error
Error: "Application error occurred during the request processing."
Troubleshooting Guide https://sdn.sap.com/irj/sdn/wiki?path=/display/jsts/home
Details: "The WebApplicationException log ID is [4698F300D2C40C2000000000000009AA]."
This error occurs both when the file is processed successfully or when in error. In case of a positive test case file, we can even see the message reaching Pipeline (SXMB_MONI). But only the audit log does not show the processed steps in the channel monitoring and displays the above error message.
We have even established that the cause of the error is Java Module (First, we executed by removing our custom Java Module from the module steps and the audit log showed the steps correctly. But by putting the module back in the channel, the error resumed).
Initially, the error was not coming and we were able to test this properly. But over the time the audit log error started. Now, we are not able to get rid of this even by restarting the channel or restarting the Java stack of the server.
To me, it seems like a memory issue in the Java Stack.
Any thoughts?
Can we find out where to find the details of the WebApplicationException log ID displayed above?
Thanks,
Sudheer

Hello,
This could be generic but may helo you:
500 Internal Server Errors
Description: The server encountered an unexpected condition which prevented it from fulfilling the request.
Possible Tips: Have a look into SAP Notes u2013 804124, 807000
Regards,
Caio Cagnani

Capture Audit log

Similar Messages

Maybe you are looking for