Job log, audit log

Hi.
Are there any log files to delete manually periodic?
I know the log files are deleted by standard delete job scheduled in Tr-cd SM36.
How about the JOB log, and audit log?
regards,

Apart from SM36 standard logs,
you might want to re-orgnaize log/trace files in various directories:
/local/data/interface - generally the interface directory
/usr/sap/<SID>/../work - Work process trace files etc.
Regards,
Siddhesh

Similar Messages

How to schedule a batch job to generate security audit log (SM20)

May be this is a repeat question for this forum. Apologize, if it is. Is there a way to schedule a batch job to generate security audit log (SM20) automatically and possibly send a message to SAP Inbox or generate a spool request? Release is 4.6C.
Regards
Nirmal

> May be this is a repeat question for this forum. Apologize, if it is.
You don't need to apologize. You only need to do a very simple search...
> Total Questions: 18 (16 unresolved)
Perhaps 16 of those 18 questions you have not followed up on could have been spared as well?
Please do the needfull.
Cheers,
Julius

Audit log trimmer timer job

HI
Audit log trimmer timer job
what this job do
I set the sitecollection audit settings to trim the audit data after 7 days
is this job before delete it generate Excel report and save in document library?
adil

The job 'Trims audit trail entries from site collections.'
It runs by defualt every month, which means you need to adjust the schedule so that it runs weekly so that it'll pick up your accelerated audit rules.
This is the job that exports the data to Excel and cleans up the entries from the database.

Audit Log Trimming Timer Job stuck at "pausing" status

Hi,
We have a SharePoint 2010 farm and our Audit table is growing rapidly. I checked our "Audit log Trimming" timer job and it has been stuck at "pausing" status for more than a month. Any advice to resolve this issue would be great.
Thanks,
norasampang

Hi Trevor,
Do you think the reason that the time job is failing is because the audit log table is big and the audit timer jod times out. I saw your reply here at this
post
where you have mentioned "
It may be timing out. Have you executed it manually to see if it runs without errors?
Can you please explain in more detail what you meant by that. I was thinking of trying to trim the Audit log using this script in small batch. Can you please let me know if this script seems right?
$site = Get-SPSite -Identity http://sharepointsite.com
$date = Get-Date
$date = $date.AddDays(-1021)
$site.Audit.DeleteEntries($date)
At first i would like to delete all datas that are older than 1021 days old and eventually get rid of the other logs in smaller chunks. Any advice and suggestion would be highly appreciated.
Thanks,
norasampang

What is Audit Log Trimming job in Sharepoint ?

What is Audit Log Trimming job in Sharepoint

Hi Sethu,
Did you understand What I am saying in the description
WhenI run the 'Audit log trimming‘ timerjob
manually for
1st 2 times report has generated then onwards it is not
generating any reports

Audit log capacity

As auditing can be enabled and it keeps the audit logs. Is there a setting for audit retention configuration as well as size configuration. Also how uch space it occupied with average audit capabilities and how much is the growth.
This topic not much covered in docs. So I want to know from you guys as you must be having enough experience. Is there a criteria which can be used to plan database. Does it go to a seperate database table?
Any pointers can also be helpful.

The job 'Trims audit trail entries from site collections.'
It runs by defualt every month, which means you need to adjust the schedule so that it runs weekly so that it'll pick up your accelerated audit rules.
This is the job that exports the data to Excel and cleans up the entries from the database.

Audit Log Fails Access Denied

Hi all,
We just recently installed SP1 for AQ6.0 and it has helped out alot. Fixed alot of our small issues, but seems to have brougt up a new one. Our Audit Log Management job is now failing every run. It is getting an Access denied error. Actually the error line is JobShell: Exception occurred when processing operation operation 0:103: \\ntapmd01\Plumtree5\PtAudit\audit 9-8-06 2.log (Access is denied). Running verbose dosen't help. I see that the job is running as owner Administrator and I am trying to copy the audit log to a shared network location, but this worked before. Nothing changed except for installing the SP. Any ideas?
Berney

First off, it seems like installing the patch reset the user account that ran the plumtree automation service. All I had to do was change the user who runs the automation service and that fixed it.
As far as service patch 1 goes we had alot of issues when we went to 6.0 with remote users opening documents. SSO redirect kept sending them back to the home page. We had issues with the Intrinsic Community Links portlet, protected excel files, along with some others I can't think of right now. Everything looked fine from the admin point of view, but users were going crazy. All of that went away with the service patch.
Thanks,
Berney

Audit Log Management

I cannot get my Audit Log Management job to run. It fails because "Invalid audit archive path. Please check your setting." Where do I check the setting? I am running 5.0.3 with Collab 4.0. Thanks.

Just an FYI, with ZDM 6.5 HP3 the file name changed from AuditLog.txt to
ZRMAudit.txt still located under system32 on Windows XP.
Jim Webb
>>> On 5/22/2006 at 3:27 PM, in message
<[email protected]>,
Jim Webb<[email protected]> wrote:
> Well I found out the ZDM 6.5 HP2 fixes the problem of the log file not
> being
> created.
>
> Jim Webb
>
>>>> On 5/19/2006 at 8:37 AM, in message
> <[email protected]>,
> Jim Webb<[email protected]> wrote:
>> Well, it does show up in the event log but not in the inventory. If I
>> disable inventory the log file won't be deleted, correct?
>>
>> Jim Webb
>>
>>>>> On 5/18/2006 at 10:03 AM, in message
>> <[email protected]>, Marcus
>> Breiden<[email protected]> wrote:
>>> Jim Webb wrote:
>>>
>>>> I did a search on a machine I am remote controlling, no log file. What
>>>> next?
>>> good question... does the session show up in the eventlog?

Problem with the XI-Audit log entries in the table "XI_AF_MSG_AUDIT"

Hi,
I have an async-szenarios for PO:
We send Idoc's from SAP ERP to a WebService via SOAP. And we take Ack's. We use Integrationsprocess with deadline block to catche the errors after the retrying (three times) and to send they via e-mail.
Our problem is, the number of the audit logs in the table "XI_AF_MSG_AUDIT":
In the RTW only we see one audit log (with three retries) in an error case. But in the table XI_AF_MSG_AUDIT there are about 76 entries for the same audit log in the error case and about 20 entries in the case of the succuessfull processing.
This number of the entries in the table causes problem with the size of the redo log file and delete job of cours the large size of the table and therefore problem on the data base. The table can not be controlled. The delete job can not run and cancels every time due this redo log problems
What can cause that?
How can it be prevented, that so much entries are not be made in the table "XI_AF_MSG_AUDIT".
Best regards
Gueltekin

Hi Gueltekin,
I am only aware of the general property auditLogEnabled of J2EE Engine Service SAP XI AF Core, which controls in general (default = true) that entries in the AF Message Audit log are written at all.
(see [http://help.sap.com/saphelp_nw70/helpdata/en/5c/22ee41c334c717e10000000a155106/frameset.htm|http://help.sap.com/saphelp_nw70/helpdata/en/5c/22ee41c334c717e10000000a155106/frameset.htm])
I assume that your scenarios in the error case is sending up to three messages and for each message the number of audit log infos are created. You might want to check the detailed entries in the log and see from where they are comming, you might use customer modules etc. as well.
Best regards,
Silvia

Fetching Audit log from sm20 tr-cd

Dear guys,
I am asking this question from quiet long time..
but no body replies with enough information....could somebody plz tell me,is this something vague job to do or my explanation is insufficient.?
i debugged the code at SM20 program too..but i could not observe the suitable FM to fetch audit log texts and put in Internal tableshortly.Even though i went thru SECU FGroup..saw audit log related FMs.
could somebody follow this post..i could reward points once i get answer for my question.
Thanks in advance.
ambichan

Hi,
You can activate the internal audit system by setting the audit log parameters as described in the following table :
Audit Log parameter settings Audit Log Parameter Set value to...
rsau/enable 1
rsau/local/file path to audit log file
rsau/max_diskspace/local maximum space to allocate for the audit files
rsau/selection_slots 3
rec/client ALL
Thanks,
Hamendra

Security Audit Log SM19 and Log Management external tool

Hi all,
we are connecting a SAP ECC system with a third part product for log management.
Our SAP system is composed by many application servers.
We have connected the external tool with the SAP central system.
The external product gathers data from SAP Security Audit Log (SM19/SM20).
The problem is that we see, in the external tool, only the data available in the central system.
The mandatory parameters have been activated and the system has been restarted.
The strategy of SAP Security Audit Log is to create many audit log file for each application server. Probably, only when SM20 is started, all audit files from all application servers are read and collected.
In our scenario, we do not use SM20 since we want read the collected data in the external tool.
Is there a job to be scheduled (or something else) in order to have all Security Audit Log available (from all application servers) in the central instance ?
Thanks in advance.
Andrea Cavalleri

I am always amazed at these questions...
For one, SAP provides an example report ( RSAU_READ_AUDITLOG_EXTERNAL ) to use BAPIs for alerts from the audit log yet 3rd party solutions seem to be alergic to using APIs for some reason.
However, mainly I do not understand why people don't use the CCMS (tcode RZ20) security templates and monitor the log centrally from SolMan. You can do a million cool things in SolMan... but no...
Cheers,
Julius

Departname in audit log report

Hi,
I am getting user data of viewing the pages within the site from audit log reports.
But our customer is expecting to see the department name of the user that he belongs to.
I dont see this value in the report.
So please let me know to get the department name of the user.
Regards,
Sudheer
Thanks & Regards, Sudheer

Hi,
Use custom code
http://sharepoint.stackexchange.com/questions/62929/get-current-users-department-name-and-manager-from-active-directory
http://sharepoint.stackexchange.com/questions/89703/getting-user-job-title-from-a-sharepoint-list-through-active-directory
Use designer workflows
http://www.sharepointanalysthq.com/2011/04/user-profile-data-in-sharepoint-designer-workflows/
Please remember to click 'Mark as Answer' on the answer if it helps you

Scheduling audit logs - variant for RSAU_SELECT_EVENTS

Hi,
I need some help as to how I should go about creating a variant for scheduling the audit logs using RSAU_SELECT_EVENTS as a weekly job.
I would like the job to run on a weekly basis (run on Sun) and to generate SM20 audit logs for that past week. For example, the job is to be executed (every) Sunday night (say, 22 Nov) and it will extract all logs between the previous Sun (15 Nov) thru to the current Sun (22 Nov).
My question is : how should the variant for the program "RSAU_SELECT_EVENTS" be created?
In this program, there's a "Time Restriction" section of "From Date" and "To Date". If I were to input 15 Nov (From Date) to 22 Nov (To Date) and schedule it weekly, then every week it is always going to extract the logs between 15 Nov and 22 Nov regardless of which Sun it was run - which is not correct.
How should the variant be created such that it will always extract the current past week?
I doubt this program can be used to achieve my requirements. Is there an alternative?
Thanks !

> I doubt this program can be used to achieve my requirements.
I raise your bet by 1 beer that it can...
=> When saving the variant, scroll along to the end of the selection options to a field called Selection Variables. Place your cursor in the date fields and press F4.
Do the same for the Name of the Variable field (tip: "-7")
Cheers,
Julius

Security audit log (SM20N)

hi,
has anyone turned on the audit log in your system ?
please share with me how you make use of this log and what to be monitored.
comment and advice will be highly appreciated.
regards,
kent

I have used and setup the audit log for a several years already and used it on several different release levels.
I can recommend using it and getting to know how to use it. To my knowledge it is the intended tool for security monitoring.
What to monitor depends on the system and events which your processes would not expect:
- Do you want users creating / changing authorizations in production?
- Use of specific tcodes, rfcs or reports (whether successful or not) which you have not restricted yet or perhaps cannot restrict due to some reason.
- Patterns which might form and otherwise go undetected.
- In the event of a breach of security, it is useful for reconstructing events (or other users from the same terminal).
Useful is also the dynamic profiles, which can be used to u201Ctrouble shootu201D or add more information for specific users (like auditors) or events as required without having to restart the system.
I recommend that you have a procedure in place how to deal with analyzing these types of logs and how to react to them! For example if someone logs on at 3 a.m. in the morning and posts some vendor invoices, then they might just be in a different time zone or a job step is running under their user ID to post the records. You should not fire the user because of that...
Protecting the logs and handling archiving and deleting of them is also a topic you should discuss with your u201Cbasisu201D team.
Cheers,
Julius

Increase retention period of Audit logs.

Friends,
We have the requirement from the Auditors to increase the retention period of logs from
3 months to 6 months.
Can someone please guide me on this one? Thanks and let me know.
Do I need to change any parameter in SAP to increase the size of Audit file @ OS level?
Any help or suggestions is helpful.
Regards,
Pranav

Lets return to the original question...
>
Pranav Thaker wrote:
> We have the requirement from the Auditors to increase the retention period of logs from
> 3 months to 6 months.
>
> Can someone please guide me on this one? Thanks and let me know.
> Do I need to change any parameter in SAP to increase the size of Audit file @ OS level?
>
> Any help or suggestions is helpful.
>
The management of daily files seems not to be the problem here, although it is relevant for the number of files created and their size... for storing them on external media for safekeeping (incase some auditor wants to read the file as well, or you do to reconstruct an event).
The possibility exists to delete the audit log files after 3 days. At the application layer, this is blocked for the 1st three days (as a security measure).
Most likely you only need to speak to your basis folks to ensure that there is enough space on the file system for the logs, and reschedule the job which is deleting the files to do so for files older than 6 months (instead of 3).
Now-a-days, 100 MB is not a lot of space and does not cost much. 600 MB will fit on a "vanialla" CD which costs less than 1 Euro. You can also copy then to an external medium before deleting them.
FYI: Reading the logs are a major pain, and I doubt that the auditors actually do this... but there are some usefull techniques you can use to send alerts when certain audit log messages appear (to solve the needle in a haystack problem) or read them all remotely and then use the same to drill down and analyze patterns. But you first need to know what the "alerts" are and which "patterns" to look for in the data you will be collecting. If you are only logging "unsuccesfull transaction start" and stuff like that, then you might as well turn it off again (even if it does keep the auditors happy).
Hope that helps a bit more,
Julius

Job log, audit log

Similar Messages

Maybe you are looking for