RPUAUD00 - Audit Log - Skipping few IT0014 records

Hi Gurus,
This is kind of strange issue that we have noticed.
Audit Log Report (RPUAUD00) is skipping few IT0014 records i.e. if there are 10 WT Records maintained as on 27.06.2011, only two are being read and the rest of them are skipped.
T585A, T585B, T585C are maintained.
Any solution to this?
Regards
Kumarpal Jain.

Hi...
This looks really a strange....
This report checks whether there are any changes in Infotypes (Masterdata) on field wise basis only.
There might be adding or deletion of wage types to those two wage types only, that's why there is no track for the remaining wage types.
Vijay
Edited by: Vijay Shankar on Jul 1, 2011 12:19 PM

Similar Messages

Audit Log update using Xchange or Webservice

Hello,
We are looking for the functionality to update Audit logs for Items.
Do we have possibility to update the Audit logs for some Particular Item by using web service or Xchange message?
The idea is to update the Audit log using some external service...
Thanks in Advance,
Regards,
Pushkar

Hi Pushkar ,
I think we cannot do this . But can you please tell me in which business scenrio you want to modified the audit Log. Audit log is meant to record changes of those selected using the audit log feature in SAP ME 5.2 .
Any update with to item would anyway (Internal or External) get updated in the audit log i believe .
Thanks
Kishore K V

Report RPUAUD00 Infotype audit log with date & time

Hi all,
I want to know from where the time is captured when we execute Report RPUAUD00 Infotype audit log?
I want to know from which fields or tables or structures?
We want to use the same logic in a custom report.
Your help appreciated.
Thanks & regards,
Vikas

Hi,
Infotype logs are maintained in PCL4 cluster. You can use fn modules HR_INFOTYPE_LOG_GET_LIST
and HR_INFOTYPE_LOG_GET_DETAIL to get infotype logs.
Thanks,
Aravind

Bad date recorded by AccessServer in Audit Log File

Hi all,
I have installed OAM and configure Audit Log File to AccessServer:
Access System Configuration >> Access Server Configuration >> and put ON "Audit to File"
The log is recorded OK, but when compare the date writed in log file with SO date, there are 6hs of diference
LOG FILE
01\/28\/2009 *00:18:07* \-0500 - AUTHZ_SUCCESS - GET - AccessServer - 192.168.3.105 - sec.biosnettcs.com\/access\/oblix\/lang\/en\-us\/msgctlg.js - cn=orcladmin\,cn=Users\,dc=biosnettcs\,dc=com - 00:18:07 - http - AccessGate - - 2
SO date
# date
mar ene 27 *18:18:15 CST* 2009
# date -u
miÃ© ene 28 *00:18:23 UTC* 2009
How we can see in this lines the audit log is recording date in UTC, but a need this in the timezone setted in SO.
How can do this (print date in audit log file with the same timezone setted by SO)??
Thaks in advance,
Julio

I response myself.
There is no way to set the Date/Time format to any other than UTC for the OAM component logs
See note 742777.1 for deeph information.
Julio.

"logon time" between USR41 and security audit log

Dear colleagues,
I got a following question from customer for security audit reason.
> 'Logon date' and 'Logon time' values stored in table USR41 are exactly same as
> logon history of Security Audit Log(Tr-cd:SM20)?
Table:USR41 saves 'logon date' and 'logon time' when user logs on to SAP System from SAP GUI.
And the Security Audit Log(Tr-cd:SM20) can save user's logon history;
at the time when user logged on, the security audit log is recorded .
I tried to check SAP GUI logon program:SAPMSYST several ways, however,
I could not check it because the program is protected even for read access.
I want to know about specification of "logon time" between USR41 and security audit log,
or about how to look into the program:SAPMSYST and debug it.
Thank you.
Best Regards.

Hi,
If you configure Security Audit you can achieve your goals...
1-Audit the employees how access the screens, tables, data...etc
Answer : Option 1 & 3
2-Audit all changes by all users to the data
Answer : Option 1 & 3
3-Keep the data up to one month
Answer: No such settings, but you can define maximum log size.
4-Log retention period can be defined.
Answer: No !.. but you can define maximum log size.
SM19/SM20 Options:
1-Dialog logon
You can check how many users logged in and at what time
2-RFC login/call
Same as above you can check RFC logins
3-Transaction/report start
You can see which report or transaction are executed and at what time
(It will help you to analyise unauthorized data change. Transactions/report can give you an idea, what data has been changed. So you can see who changed the data)
4-User master change
(You can see user master changes log with this option)
5-System/Other events
(System error can be logged using this option)
Hope, it clear the things...
Regards.
Rajesh Narkhede

BOE XI 3.1 Removing Audit log files

Hi there experts,
we have an issue with our production BOE install (3.1 SP7) whereby we have over 39,000 audit log files awaiting processing in the BOE_HOME/auditing folder. These audit files were generated a few months back when we had an issue with the system whereby thousands of scheduled events were created, we are not sure how. The removal of these events has had a knock on effect in that we have too many audit files to process, ie the system just cant process them all quickly enough.
So my question is can we just remove these audit files from the auditing directory with no knock on effects as we dont need them loading into the audit database anyways as they are all multiples of the same event.
As an aside when we upgraded from SP3 to SP7 the problem went away, ie no new audit files for these delete events being generated. We are still to establish how/why these audit events were created but for the time being we just want to be able to remove them. Unfortunately as its a production system we don't want to just take a chance and remove them without some advice first.
thanks in advance
Scott

Is your auditing running now? Or still pending? Can you check in Audit DB, what is the max(audit_timestamp? This will tell you when was the recent actvitiy happened.
Deleting the audit files, will not harm to your BO system. You will not be able to see auditing details for that period.
Is the new auditing files are processed? or you still see the files created in auditing folder without processing?
If the auditing file size shows 0 okb, than it means they were processed.

Audit Log Not Being Created

Hi,
I'm using the workflow application "Audit" as an activity in my custom workflow and I'm passing the required arguments.
In the workflow trace file, I can see that the Audit application is run using the passed parameters but no record is being created matching that information in the "log" table.
Any ideas/suggestions?
Thanks
Here is the trace for your information:
Resolved reference requesterWSUser = object
Assigning requesterFullName = Test1 Manager1
Action Set Audit Resources List
Result title set to 'Set Audit Resources List'
Evaluating XPRESS
Resolved reference approved = false
Resolved reference auditApps = [AD_Simulated]
Resolved reference auditApps = [AD_Simulated]
Assigning depApps = [AD_Simulated]
Action Audit
Result title set to 'Audit'
Iterating over depApps = [AD_Simulated]
Iteration 0
app = AD_Simulated
Argument op = audit
Argument type = User
Argument status = success
Argument action = View
Argument reason = User Access Recertification
Argument subject = TestManager1
Resolved reference user.waveset.organization = null
Resolved reference app = AD_Simulated
Resolved reference app = AD_Simulated
Argument resource = AD_Simulated
Resolved reference enduserId = testuser4
Argument accountId = testuser4
Resolved reference enduserView.accounts[Lighthouse].firstname = Test4
Resolved reference enduserView.accounts[Lighthouse].lastname = User4
Resolved reference enduserId = testuser4
Resolved reference requesterFullName = Test1 Manager1
Argument error = The access of the user Test4 User4(testuser4) has been recertified by Test1 Manager1
Calling application 'com.waveset.session.WorkflowServices'
Application requested argument op
Application requested argument logResultErrors
Application requested argument action
Application requested argument status
Application requested argument type
Application requested argument subject
Application requested argument name
Application requested argument resource
Application requested argument accountId
Application requested argument error
Application requested argument parameters
Application requested argument attributes
Application requested argument originalAttributes
Application requested argument overflowAttributes
Application requested argument auditableAttributesList
Application requested argument organizations
Step complete 'Audit'
Step inactive 'Display Message'
-------------------------------------------------------------------------

I agree with the anokun7. Check to make sure the action your are giving it is a valid one. ( See IDM Workflow Forms and Views pdf and search for Action Names, it will give you a list of all the valid actions) Also you can add your own attributes to the Audit object as well using the attributes variable. ( It expects a map: <map>
<s>Key</s>
<ref>value</ref>
<map>
Value can be a reference, or string, or however complex you want to make it. Just be aware of what view (if any) is available at the time you call the audit. Hope this helps
Message was edited by:
dmac28
Oh yeah..The attributes will appear on the audit log reports, Based on what action and type you audited it will show up on that record. i.e Delete action, on Type User...that audit record will have a changes value which will have whatever attributes you passed to the audit object.

Audit log + manual update + specify download location

Hi all,
I'm evaluating whether we can use Java Web Start for our new product, for geographically distributed software deployment.
I've the following questions that I could not find answers in the official documentation:
- Can it support manual update? i.e. is there any way I can put a button on the application UI so that instead of checking latest version on every program start, the end-user can manually initiate software update.
- Can I extend it to support audit log? i.e. we need to keep track of which client upgrade to which version in a centralized database (as audit trail), and when such update occurred. Can we do this?
- Some of our end-user has no access to local filesystem, they only have access to dedicated shared network drive, can we customize Web Start so that it download and save the new version to a specific location, instead of C:\temp?
- We have a few jar files for the application. How can we ensure that all jar files are either updated, or not updated at all? i.e. kind of transaction concept.
- One of the jar files contains some configuration files, which need to be expanded in exploded format (to allow runtime change of configuration options). How can we do that?
Thanks a million.

Hi all,
I'm evaluating whether we can use Java Web Start for
our new product, for geographically distributed
software deployment.
I've the following questions that I could not find
answers in the official documentation:
- Can it support manual update? i.e. is there any
way I can put a button on the application UI so that
instead of checking latest version on every program
start, the end-user can manually initiate software
update.currently, no - this is a requested feature being considered for 6.0
>
- Can I extend it to support audit log? i.e. we need
to keep track of which client upgrade to which
version in a centralized database (as audit trail),
and when such update occurred. Can we do this?only by controling a servlet or jsp page that generates the jnlp file and keeps track of what requests are made for the jnlp file and the resources of the app. Java Web Start itself runs on the client machine.
>
- Some of our end-user has no access to local
filesystem, they only have access to dedicated shared
network drive, can we customize Web Start so that it
download and save the new version to a specific
location, instead of C:\temp?webstart itself only downloads into its own cache (by default on windows XP at c:\Doccuments and settings\<user name>\Application Data\Sun\java\deployment\cache\javaws
this cache location can be configured.
in version 6.0 we will have capability to disable caching, but curent version must have a cache.
>
- We have a few jar files for the application. How
can we ensure that all jar files are either updated,
or not updated at all? i.e. kind of transaction
concept.
Java web Start currently checks timestamps of all downloaded jars before launching application, and will only update all or none.
- One of the jar files contains some configuration
files, which need to be expanded in exploded format
(to allow runtime change of configuration options).
How can we do that?If you must access these resources as files, you will have to extract them using ClassLoader.getresourceAsStream(), and then write them to disk yourself.
>
Thanks a million./Andy

Audit Log query

I am trying to figure out why a query of the OID audit logs is taking so long....
the search filter is:
(&(orcleventtime>=20070426)(orcleventtime<=20070427)(orcleventtype=User login))
it takes 97 seconds to return 1622 entries.
when i run a query with this filter....
(&(orcleventtime>=20070426)(orcleventtype=User login))
it takes 0.2 seconds
any ideas?

Purging an AUD$ table is good idea after taking the export....
Yeah...that could be better idea to audit those things that application skips...
I was just getting calls from finance and operations departments... complaining that their ERP applications were haning taking long time to execute day end procedures and in reports...around 20 to 30 minutes.... as I recalled that my last deployment on live was enabling of auditing as I executed noaudit all and noaudit select, update, delete, insert on erp, The user got their day end procedures executed and report in less than 1 minute...
Can anybody explain me....Does auditing degrades performance..?
Regards?

Audit log of customized table.

Dear experts,
I need to trace log of some tables.
In spro transacction there is one customize transacction KEDE. This transacction is used to define derivation rules and generates entries with tables names. This records are generated in TKEDRS table. I do not need to audit this table. I need to audit some the tables recorded in field table of table TKEDRS.
K9XXXYYYNNNN.
XXX- ID SYSTEM
YYY- ID CLIENT
NNNN-Number
This custom point generates tables in dictionary. I need to trace this tables for audit log of changes. One solucion is configure SCU3 and tables in SE11.
This table do not have modification digalog. (cdhdr, cdpos, ... ) tables.
Are there other solution?
Thanks and regards.
David Sánchez.

Dear experts,
I need to trace log of some tables.
In spro transacction there is one customize transacction KEDE. This transacction is used to define derivation rules and generates entries with tables names. This records are generated in TKEDRS table. I do not need to audit this table. I need to audit some the tables recorded in field table of table TKEDRS.
K9XXXYYYNNNN.
XXX- ID SYSTEM
YYY- ID CLIENT
NNNN-Number
This custom point generates tables in dictionary. I need to trace this tables for audit log of changes. One solucion is configure SCU3 and tables in SE11.
This table do not have modification digalog. (cdhdr, cdpos, ... ) tables.
Are there other solution?
Thanks and regards.
David Sánchez.

How change sStart and End Date and time in the Audit log ???

Install C2S BM39SP1. Work.
Go to the: https://bmserver:8009
Open : VPN Monitor | Audit log information.
Problem - can not cahnge Date and time in the Audit Log Start(End)
How i vcan do this ?
How i can get every day stat log:
login ; date_time_login ; dtae_timie_logout ; bite_in ; bite_out
Serg

Serg,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://support.novell.com/forums)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://support.novell.com/forums/faq_general.html
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Getting the name of the program or the FM called from security audit log

Dears,
Is there a way to get the name of the ABAP program called through transaction SE38, or the FM called through transaction SE37, from the security audit log ?
What is available is only : RSABAPPROGRAM for transaction SE38, and RSFUNCTIONBUILDER for transaction SE37
Thanks.
Reda

I had always assumed this log to be in the SUBMIT statement, but never used it.
If I remember correctly this is recorded it the runtime submit, so it should be there.
Perhaps it is only in selected reports? I will check in my system.
Please compare with sm20n and run the report from sa38. The submits are different in sa38 etc compared to se38.
The FM will only be recorded it it has a destination extention in the source system which is mostly remote. Local fm calls are not recorded for sure.
Cheers,
Julius
Edited by: Julius Bussche on Jul 26, 2011 11:32 PM

Ms-exchange 2013 audit logs retrieving in csv format not working?

I need help regarding pulling specific information from exchange 2013. The information pertains to mail-exchange audit logs. The exchange in my environment is ms-exchange 2013. Steps performed so far are:-
**step#1**
Create test Environment on Exchange Server 2010 and Active Directory:
Two Mailboxes for testing (with dummy email messages) (i.e., test-mailbox-1, test-mailbox-2)
Two Active Directory Accounts for testing (testAcct01, testAcct02)
Assign Permission to Test Mailboxes: Owner of Email Box test-mailbox-1: testAcct01, Owner of Email Box test-mailbox-2: testAcct02
**step 2**
Enable Mailbox Auditing on the test-mailbox-1:
Use EMS to enable mailbox auditing on mailbox: test-mailbox-1
Commands:
o Set-Mailbox -Identity "test-mailbox-1" -AuditDelegate Copy,Create,FolderBind,HardDelete,Move,MoveToDeletedItems,SendAs,SendOnBehalf,SoftDelete,Update -AuditEnabled $true
o Set-Mailbox -Identity "test-mailbox-1" -AuditAdmin Copy,Create,FolderBind,HardDelete,MessageBind,Move,MoveToDeletedItems,SendAs,SendOnBehalf,SoftDelete,Update -AuditEnabled $true
Note: You must have permission for Organization Management and Record Management if you want to enable mailbox auditing.
**step#3**
Verify that the Mailbox Auditing is Successfully enabled for mailbox: test-mailbox-1:
 Use EMS to verify the settings of mailbox auditing
Command:
o Get-Mailbox "test-mailbox-1" | Format-List *audit*
**step#4**
Verify that the Mailbox Auditing is Successfully enabled for mailbox: test-mailbox-1:
Use EMS to verify the settings of mailbox auditing
Command:
o Get-Mailbox "test-mailbox-1" | Format-List *audit*
**step#5**
Perform test activities on mailbox “test-mailbox-1” using account id: testAcct02
For Example: Access Inbox folder, move items from one folder to another folder, delete items, read messages, send email using SendAs and SendOnBehalf, create new folder, copy email items etc.
**step#6**
Perform test activities on mailbox “test-mailbox-1” using “Administrator” Account.
For Example: Access Inbox folder, move items from one folder to another folder, delete items, read messages, send email using SendAs and SendOnBehalf, create new folder, copy email items etc.
**step#7**
Use EMS Cmdlet to retrieve Mailbox audit logs for mailbox “test-mailbox-1”
Command:
o Search-MailboxAuditLog -Identity test-mailbox-1 -LogonTypes Admin,Delegate –ShowDetails -StartDate mm/dd/2014 -EndDate mm/dd/2014 | Export-Csv “c:\test-Audit-Results.csv”
o New-MailboxAuditLogSearch "Admin and Delegate Access" -Mailboxes " test-mailbox-1" -LogonTypes Admin,Delegate -StartDate mm/dd/2014 -EndDate mm/dd/2014 -StatusMailRecipients [email protected]
I'm unable to go past step#7, as I see nothing in csv file. I don't know why is this? any help.

Hi,
I will perform these steps in my lab and paste the result.
Beg your patient waiting.
Thanks
Mavis
Mavis Huang
TechNet Community Support

Content of the Audit Log

Hello,
It seems that the text of the audit log is contained in table xi_af_msg_audit ins the J2EE schema under field text_key.
If I access this key directly from the database it seems to be unnecessarily long, with a lot of blank space padding.
Is it possible to control what is recorded in this field and hence what is displayed in the Audit Log?
Kind regards,
Peter

You can simply use the AuditMessageKey class to write your own audit log entries. A similar code would be
AuditMessageKey auditMKey = new AuditMessageKey(message.getMessageId(), AuditDirection.INBOUND);
          Audit.addAuditLogEntry(
               auditMKey,
               AuditLogStatus.SUCCESS,
               "Custom Message");
Regards,
Prateek

Using crystal report to extract data from Audit Log

I have a customised form which contains main fields (i.e 20 fields) and when a field is changed, it's being recorded in the audit log.
Would it be possible to use Crystal Report to extract data from the Audit Log? Ideally, i would like the report to show me all the latest field values in a spreadsheet type format (i.e. one field per column)
Has anyone try this and if so, what is involved?

An element with both text & a sub-element is a mixed-content element.
For example ElementA is a mixed content element.
<ElementA>
Text
<ElementB></ElementB>
</ElementA>
Extract just the Text from ElementA.
<xsl:template match="ElementA">
<xsl:apply-templates select="text()" />
</xsl:template>

RPUAUD00 - Audit Log - Skipping few IT0014 records

Similar Messages

Maybe you are looking for