Scheduling audit logs - variant for RSAU_SELECT_EVENTS

Hi,
I need some help as to how I should go about creating a variant for scheduling the audit logs using RSAU_SELECT_EVENTS as a weekly job.
I would like the job to run on a weekly basis (run on Sun) and to generate SM20 audit logs for that past week.  For example, the job is to be executed (every) Sunday night (say, 22 Nov) and it will extract all logs between the previous Sun (15 Nov) thru to the current Sun (22 Nov).
My question is : how should the variant for the program "RSAU_SELECT_EVENTS" be created?
In this program, there's a "Time Restriction" section of "From Date" and "To Date".  If I were to input 15 Nov (From Date) to 22 Nov (To Date) and schedule it weekly, then every week it is always going to extract the logs between 15 Nov and 22 Nov regardless of which Sun it was run - which is not correct.
How should the variant be created such that it will always extract the current past week?
I doubt this program can be used to achieve my requirements.  Is there an alternative?
Thanks !

> I doubt this program can be used to achieve my requirements.
I raise your bet by 1 beer that it can...
=> When saving the variant, scroll along to the end of the selection options to a field called Selection Variables. Place your cursor in the date fields and press F4.
Do the same for the Name of the Variable field (tip:  "-7")
Cheers,
Julius

Similar Messages

  • Powershell script to get Audit log settings for all site collections.

    Hi all,
    I am facing issue to get audit log details for all site collection across the farm with the below script. Could someone help me change the script.
    Function AuditValue($url)
    $site=Get-SPSite $url
    auditMask = $site.audit.auditflag
    return auditMask
    Get-SPSite -Limit All | Get-SPWeb -Limit All |
    Select Title,Url,AuditValue(Url)| export-csv "D:\scripts\Test\AuditDetails.csv" -notypeinformagettion
    Thanks Basva

    What errors are you getting? That is if any.
    Scrap that I see a few.
    Not had time to fix it fully. As I am now done at work, but this will help you on your way. It gets back only the audit flag value at the moment.
    Function AuditValue
    $site = Get-SPWeb "http://server" -limit ALL
    foreach($i in $site)
    $auditMask = $site.audit
    $list = $auditMask
    $list | Select-object auditflags
    AuditValue | out-file "C:\temp\AuditDetails.csv"
    EDIT::
    Function AuditValue
    $site = Get-SPWeb "http://SERVER" -limit ALL
    foreach($i in $site)
    $auditMask = $site.audit
    $list = $auditMask
    $list | Select-object @{Name="URL"; Expression ={$site.url}}, auditflags
    AuditValue | out-file "C:\temp\AuditDetails.csv"
    The above will also put URL 
    If this is helpful please mark it so. Also if this solved your problem mark as answer.

  • Security Audit Log SM19 and Log Management external tool

    Hi all,
    we are connecting a SAP ECC system with a third part product for log management.
    Our SAP system is composed by many application servers.
    We have connected the external tool with the SAP central system.
    The external product gathers data from SAP Security Audit Log (SM19/SM20).
    The problem is that we see, in the external tool,  only the data available in the central system.
    The mandatory parameters have been activated and the system has been restarted.
    The strategy of SAP Security Audit Log is to create many audit log file for each application server. Probably, only when SM20 is started, all audit files from all application servers are read and collected.
    In our scenario, we do not use SM20 since we want read the collected data in the external tool.
    Is there a job to be scheduled (or something else) in order to have all Security Audit Log available (from all application servers) in the central instance ?
    Thanks in advance.
    Andrea Cavalleri

    I am always amazed at these questions...
    For one, SAP provides an example report ( RSAU_READ_AUDITLOG_EXTERNAL ) to use BAPIs for alerts from the audit log yet 3rd party solutions seem to be alergic to using APIs for some reason.
    However, mainly I do not understand why people don't use the CCMS (tcode RZ20) security templates and monitor the log centrally from SolMan. You can do a million cool things in SolMan... but no...
    Cheers,
    Julius

  • An error occurred while trying to access the audit log

    Hi I have run Set-Mailbox ian.shapton -AuditOwner Update, Move, MoveToDeletedItems, SoftDelete, HardDelete
    I then created and deleted an email and ran Search-MailboxAuditLog -Identity "ian shapton" -LogonTypes Owner -StartDate "12/21/2014 12:00" -EndDate "12/21/2014 13:00" -ShowDetails
    I see An error occurred while trying to access the audit log. For more details, see the inner exception.
        + CategoryInfo          : NotSpecified: (:) [Search-MailboxAuditLog], AuditLogException
        + FullyQualifiedErrorId : [Server=Mailbox01,RequestId=07f17915-f25d-4fd5-b23e-f07a2482f4a4,TimeStamp=21/12/2014 16:45:39] [FailureCategory=Cmdlet-AuditLogException] 255D6156,Microsoft.Exchange.Management.SystemConfigurationTasks.SearchMailboxAuditLog
    MSExchange CmdletLogs shows Microsoft.Exchange.Data.ApplicationLogic.AuditLogServiceException: The Exchange Web Service returned an error while trying to access the audit log. Reason: 'Error','ErrorTimeoutExpired','The search operation could
    not be completed within the allotted time limit. Please try to narrow down your scope to reduce the result set.'.
    I am a Recipient Admin and Org Admin and can search other mailboxes using -LogonTypes Delegate
    Any idea what I am missing here?
    shapi

    Hi,
    I have the same problem when I run the Search-MailboxAuditLog command.  It has been working for 2 weeks but suddenly after moving databases from one datacenter to another and back again it stopped working.  The account running the command
    is in all necessary roles needed.
    This is what I have tested after it stopped working:
    - Search-MailboxAuditLog -Identity "xxxxxxx" -LogonTypes Delegate -StartDate (Get-Date).Adddays(-1) = Works
    - Search-MailboxAuditLog -Identity "xxxxxxx" -LogonTypes Delegate -StartDate (Get-Date).Adddays(-1) -showdetails = does not work and comes with an error.
    "The Exchange Web Service returned an error while trying to access the audit log. Reason: 'Error','ErrorTimeoutExpired',
    'The search operation could not be completed within the allotted time limit. 
    Please try to narrow down your scope to reduce the result set.'."
    This is very bad for us because we use a lot of shared mailboxes with delegates and want to report delegate action on these mailboxes.
    Environment:
    - 3 datacenters
    - Exchange 2013 CU7
    Thorir
    thorir

  • Audit Log Report generating an "Out of Memory" error message.

    Greetings. We are a new IDM customer. We are running IDM 6.0 with an Oracle database. We are now getting the following error message when we run the IDM Audit Log Report for Today's Activities:
    "java.lang.OutOfMemoryError".
    How do we increase the memory setting for reporting? Thanks.

    Hi,
    I am also getting the same error. I have netbeans with tomcat andi modified the setting the netbeans.conf to
    netbeans_default_options="-J-Xms32m -J-Xmx750m -J-XX:PermSize=32m -J-XX:MaxPermSize=750m -J-Xverify:none -J-Dapple.laf.useScreenMenuBar=true"
    i have 896MB of RAM. However, the error is still showing up? Any ideas on how to resolve this?
    Thanks,

  • Audit log is empty in RWB CC Monitoring

    Hi experts,
    I am facing a problem with the message monitoring in the RWB. The Audit Log tab for the message details has nothing while the Message Content and Message data contain information about the message. I have set the parameter message.auditLogEnabled to false for the service com.sap.aii.af.svc in the NWA and restarted the instance but with no luck. Please help me out.
    Regards.

    Hi Prateek,
    That parameter was 'true' by default.
    As per this blog,
    http://www.sdn.sap.com/irj/scn/weblogs;jsessionid=(J2EE3417800)ID0321728450DB01035845556380020404End?blog=/pub/wlg/13456
    I changed it to 'false'. The persistence of messages is 24 hours, which is fine.
    I am now trying to look at the table XI_AF_MSG_AUDIT. It has about 800K records in it, in which about 80k have 'DLNG' as their status. Do you think this is causing any problem?
    Regards.

  • Adding entries in Audit Log Tab in Component Monitoring under Runtime Workb

    Hello Experts,
    I am trying to add my own audit log entries to the Audit Log Tab under Runtime Workbench -> Component Monitoring. I found this sap help link (http://help.sap.com/saphelp_nwpi71/helpdata/en/3b/6fe540b1278631e10000000a1550b0/frameset.htm) I am not sure if i am going in the right direction or not. But, when I tried to use the code in my User Defined Function in Message Mapping it gives me java error on PublicAPIAccess.
    Can anyone please let me know what am i doing wrong or if I am going in a totally wrong direction to achieve me goal.
    I am using PI 7.1 without EP1 and my example uses File adapter.
    Thanks!!

    Hi,
    if you are trying to add custom audit log for system monitoring in RWB in component monitoring, then i think it is not feasible........moreover for this thing, you can ask your basis guys to configure CCMS in your XI system to recieve alerts for your system.............
    if you are trying to add custom audit log msgs for your msg processing, then you should develop a custom J2EE adapter module and add your audit log entries in the process method of your adapter module..............
    Regards,
    Rajeev Gupta
    Edited by: RAJEEV GUPTA on May 6, 2009 7:12 AM

  • Can't enable mailbox audit logs

    Hello!
    I can't enable mailbox audit logs. I use cmdlet Set-Mailbox -Identity "mailbox" -AuditEnabled $true and Get-Mailbox shows that
    audit is enabled. But when i check Get-Mailbox| Get-MailboxFoldersStatistics there is no "Audit" subfolder, and all audit searches also return no results. 
    I am working now with several Exchange installations (five actually, and one is brand-new test lab) and checked the same in each organization. Result was the same!
    I am stronly sure i miss something important, could you point it to me?

    Hi,
    Please use the following command to check the Mailbox Audit Logging action setting.
    Get-Mailbox –Identity “username” | fl name,*audit*
    Are there any administrator, delegate, and owner actions in the audit logging configuration for that mailbox? Please post them to check this issue.
    If the settings above are configured correctly, only the administrator, delegate, and owner actions specified in the audit logging configuration for the mailbox are logged. And the “Audits” folder will show up after the administrator, delegate,
    and owner take the actions specified in the audit logging configuration.
    By default, these actions in the audit logging configuration should be like this:
    AuditAdmin        : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create}
    AuditDelegate   : {Update, SoftDelete, HardDelete, SendAs, Create}
    AuditOwner        : {}
    By the way, which command do you use to search the audit log?
    Mailbox audit logging procedures
    https://technet.microsoft.com/en-us/library/ff461939%28v=exchg.150%29.aspx?f=255&MSPPError=-2147217396
    Best Regards.
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
    Lynn-Li
    TechNet Community Support

  • How to extract audit log data from every document library in site collection using powershell?

    Hi All,
    I have n number of document library in one site collection,
    My query is- How to extract audit log data from every document library in a site collection using powershell?
    Please give solution as soon as possible?

    Hi inguru,
    For SharePoint audit log data, These data combine together in site collection. So there is no easy way to extract audit log data for document library.
    As a workaround, you can export the site collection audit log data to a CSV file using PowerShell Command, then you can filter the document library audit log data in Excel.
    More information:
    SharePoint 2007 \ 2010 – PowerShell script to get SharePoint audit information:
    http://sharepointhivehints.wordpress.com/2014/04/30/sharepoint-2007-2010-powershell-script-to-get-sharepoint-audit-information/
    Best Regards
    Zhengyu Guo
    TechNet Community Support

  • Audit log SM19

    Hi,
    We have created a filter on SM19 with these events:
    What does it means that all events related with the for e.g  with the Application server started are recorded on the audit log but for e.g events related with the Non-exclusive debugging session started not ?
    Thanks a lot and best regards, Carolina

    Hi Carolina,
    What does it means that all events related with the for e.g  with the Application server started are recorded on the audit log but for e.g events related with the Non-exclusive debugging session started not ?
    Whichever checkbox has been selected, you may have audit log recorded for the same,
    You can record the following information in the Security Audit Log:
    - Successful and unsuccessful dialog logon attempts
    - Successful and unsuccessful RFC logon attempts
    - RFC calls to function modules
    - Changes to user master records
    - Successful and unsuccessful transaction starts
    - Changes to the audit configuration
    Hope this helps.
    Regards,
    Deepak Kori

  • TFS 2013 - Export Audit Log - API?

    Trying to use the new 2013 access audit log found on the "Access Levels" Admin web page to compare against list of users with MSDN accounts to ensure licensing compliance.  While I can manually export the access log to .csv per the built-in
    functionality, is the audit log accessible via the TFS API?
    Would like to automate, say obtaining audit log entries for the last 6 months ... within a PS script.

    Hi Jdlaw64,  
    Thanks for your post.
    The Export Audit Log shows all current users and groups information in TFS Server, it contains all the information of who accessed the TFS Server and when they did that, and it also shows what level of access that user or group has. We cannot get the entries
    from this log by date time(last 6 months).
    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click
    HERE to participate the survey.

  • Generating Audit log report using PowerShell script

    Hi All,
    I have a requirement to generate the audit log report for a Document library/ custum list. Like 
    1) Who had downloaded and when for the site
    2) Respective username,date time
    3) URL of the document / subsite name etc.
    if it possible, how to automate the process in weekly basess.
    I know it can be done through OOB. Audit log reports 
    can any one help on this?
    Below URL i had for reference : http://social.technet.microsoft.com/wiki/contents/articles/23900.get-audits-for-a-sharepoint-document-using-powershell.aspx
    Vijaivel

    Hi Peter,
    thanks for your reply, URLS are good but am having limited access (i.e) am not a sitecollection Aministrator. So I will not have the access for SiteCollection Administrator section. I having the only one option is Site Collection Web Analytic report. Is
    it possible to achive with this option? or anyother work around ?
    Suggest any other option for automated notification process
    Thanks
    Vijaivel

  • How to schedule a batch job to generate security audit log (SM20)

    May be this is a repeat question for this forum. Apologize, if it is. Is there a way to schedule a batch job to generate security audit log (SM20) automatically and possibly send a message to SAP Inbox or generate a spool request? Release is 4.6C.
    Regards
    Nirmal

    > May be this is a repeat question for this forum. Apologize, if it is.
    You don't need to apologize. You only need to do a very simple search...
    > Total Questions:  18 (16 unresolved) 
    Perhaps 16 of those 18 questions you have not followed up on could have been spared as well?
    Please do the needfull.
    Cheers,
    Julius

  • Logs vary in sm20 and RSAU_SELECT_EVENTS

    Hi,
    Logs which appear in sm20 do not appear in RSAU_SELECT_EVENTS. why is this happeneing?
    Regards
    Divya

    Hello Annie,
    It is simple. You need a create a dynamic variant for it.
    If you want is step by step here it is:
    Execute the report in SE38. In the selection screen you will have the date auto populated. Ignore it. Just press the save option. You will come to the screen:
    ABAP:Save as variant.
    Give the variant a name and a description.
    Under the section FELD NAME you will find two entries for current date. Also there will be lots of check boxes infront of the fields. For both the entries of current data select the check boxes which are under the column marked "L" (Selection variable).
    After this press the pushbutton selection variables.
    In the next screen you will find two tabular entries for current date .Adjacent to them you will havethe choice to have the kind of selection you want. You will notice that color under column D(Dynamic date calculation) is yellow. Click on the yellow icon to select dynamic date selection. It will turn green. However the adjacent one under column T will turn yellow.
    Repeat this for second entry for Current date as well.
    Now we will come to part where you cando dynamic date selection.
    For the first entry for current data you will notice a downward arrow under column T(yellow light).
    Click on that arrow a pop up would come which would allow you to choose the date you want. Choose first day on the current month.
    Repeat the second entry the same only difference being thatthe date you will choose is the last day of the current month.
    Save the changes for selction variable screen as well Abap variant screen and test your variant.
    I hope it works. Please award points accordingly.
    Regards.
    Ruchit.

  • SQLException in the audit log for the Message Display Tool

    Hi
    I´m newbie in PI Technology, and i have some issues when i try to do the next.
    This is the scenario:
    I need to communicate two systems, for one side i have SAP, and for the other side i have ADI (legal system) so, i use PI to do this (the communication), PI receive the data from SAP by means abap proxy, until this everything is correct, then i do the mapping of the data and i send a message to ADI (with the SAP XI Runtime Workbench) by means JDBC adapter, if i check the sended message with "Message Display Tool" show that the message was sent (status "Delivered") but if i check the received messages option, in the audit log displays the five next errors:
    Error: Could not execute statement for table/stored proc. "FADIA4" (structure "StatementFADIA4") due to java.sql.SQLException: FADIA4 in FILEMET not valid for operation.
    Error: JDBC Message processing failed, due to Error processing request in sax parser: Error when executing statement for table/stored proc. 'FADIA4' (structure 'StatementFADIA4'): java.sql.SQLException: FADIA4 in FILEMET not valid for operation.
    Error: MP: exception caught with cause com.sap.engine.interfaces.messaging.api.exception.MessagingException: Error processing request in sax parser: Error when executing statement for table/stored proc. 'FADIA4' (structure 'StatementFADIA4'): java.sql.SQLException: FADIA4 in FILEMET not valid for operation.
    Error: Adapter Framework caught exception: null
    Error: Delivering the message to the application using connection JDBC_http://sap.com/xi/XI/System failed, due to: com.sap.engine.interfaces.messaging.api.exception.MessagingException: Error processing request in sax parser: Error when executing statement for table/stored proc. 'FADIA4' (structure 'StatementFADIA4'): java.sql.SQLException: FADIA4 in FILEMET not valid for operation..
    if there are somebody that maybe could know what is the problem?, could the problem be the side of the legal system?, because inside of PI when i do the Test Configuration in the Integration Directory, the end of the test is successful.
    Any comment is well received!!
    Thanks,
    Vicman
    P.D. sometimes the error is: java.sql.SQLException: Token ) was not valid. Valid tokens: DAY PATH YEAR LABEL MONTH OPTION RESULT CONNECTION TRANSACTION.
    what does it means?

    Hi Pooja,
    thanks for you quickly response!
    XML sended:
    <?xml version="1.0" encoding="UTF-8"?>
    <ns0:MT_PgDocVentaECC_req xmlns:ns0="http://gmodelo.com/ECC/enviarCobranza">
       <DT_DatosDeControl>
          <MIDDLEWARE_ID/>
          <QUICK_ID/>
          <INTERFACE_NAME/>
          <MESSAGE_ID/>
          <LOG_ID/>
          <USER_ID/>
          <SOURCE_SYSTEM/>
          <TARGET_SYSTEM/>
       </DT_DatosDeControl>
       <DT_PagoDocVentaECC>
          <VKORG>TVKO</VKORG>
          <VKBUR>TVBUR</VKBUR>
          <VKBUR1>TVBUR</VKBUR1>
          <ROUTE>TVRO</ROUTE>
          <ROUTE1>TVRO</ROUTE1>
          <BLART>Q</BLART>
          <BELNR>100</BELNR>
          <WRBTR>200</WRBTR>
          <LFART>100</LFART>
          <VBELN>100</VBELN>
       </DT_PagoDocVentaECC>
    </ns0:MT_PgDocVentaECC_req>
    this is the XML received:
    <?xml version="1.0" encoding="UTF-8"?>
    <ns1:MT_PgDocVentaADI_req xmlns:ns1="http://gmodelo.com/ADI/recibirCobranza">
    <StatementFADIA7>
    <FADIA7action="INSERT">
    <Table>FADIA7</Table>
    <Access>
    <NUMCIA>123</NUMCIA>
    <NUMALM>234</NUMALM>
    <SUBALM>300</SUBALM>
    <CVETOP>16</CVETOP>
    <FOLOPV>22</FOLOPV>
    <SECOVA></SECOVA>
    <IMPOVA>200</IMPOVA>
    <ALMOVA>5678</ALMOVA>
    <SUBOVA>21</SUBOVA>
    <TOPOVA>21</TOPOVA>
    <FOPOVA>41</FOPOVA>
    <FECOVA>100</FECOVA>
    <STSOVA> </STSOVA>
    </Access>
    </FADIA7></StatementFADIA7>
    </ns1:MT_PgDocVentaADI_req>
    what do you think about it?, anything wrong?

Maybe you are looking for

  • Minimizing Mini-Bridge & Timeline in Photoshop CS6

    Quick question that I can't figure out.  How do I minimize the Mini-Bridge and Timeline in Photoshop CS6?  I have draged the window section as far down as possible.  But, I have seen some PS6 screenshots were the timeline and mini-bridge lay flush wi

  • Trouble creating links to files

    when publishing a PowerPoint with hyperlinks to another document the Adobe presenter does not allow the link to operate have followed the help instructions for add and edit attachments andlinks to documents without success

  • Is it safe to install windows 7 in macbook air which just have 128gb of memory with vmware?

    is it safe to install windows 7 in macbook air which just have 128gb of memory with vmware?

  • Selecting relevant layout -BASIS

    Dear Folks, I have made 6 layouts for a standard report. When i run a Background job for this report program how should i define the required Layout. Kindly advise. Regards, KK

  • Backup rman catalog

    Hi my RMAN catalog db is is non archive log mode and we never back it up for better protection , i will convert it to archive mode and hotbackup it and use controlfile as catalog am i in the right way to backup my rman catalog db? Thanks