Security audit log for the last 30 days?

Question

Hi,
My current settings for the security audit log is 20 MB (by default).  I dont want to control it with file size limitation, but by the no. of days the audit is recorded (max 30 days).
What are the parameters that I would need to maintain?
Or any additinal config is required?
Thanks,
Abdul

Answer 1

Hi,
My current configuration is like this:
Name                Description                                           Current value                                            System default value
FN_AUDIT     Name of security audit file          audit_++++++++
DIR_AUDIT     Directory for security audit files     /usr/sap/GSP/DVEBMGS00/log     /usr/sap/GSP/D00/log
rsau/enable     Enable Security Audit          0
rsau/max_diskspace/local     Maximum space for security audit file     300M     20M
rsau/max_diskspace/per_day     Maximum size of all security audit files per day          0
rsau/max_diskspace/per_file     Maximum size of one single security audit file          0
rsau/selection_slots     Number of selection slots for security audit          2
rsau/user_selection     Defines the user selection method used inside kernel functions          0
I have just activated the audit, and in just 30 minutes, I can see that the file is about 45MB.  If this is the growth rate, the 300MB allocated for audit will completely used in just a day.
My requirement is - I want to track users and their activities for the last 30 days (or 45 days).  No log should be overwritten unless it is atleast 30 days old.
In SM20, when I give selection from 1.1.10 to 31.1.10, it should show me all the activities during this period, without any breaks.
Other doubts: Do I have to start auditing manually every day?  Or will it keep writing logs until it reaches 300 MB which can spread upto multiple days.
Regards
Abdul
Edited by: Abdul Rahim Shaik on Feb 4, 2010 11:17 AM