SM20 report shows empty result

Hi All,
Issue in Audit sm20:
one of the account with special privileges which was set open for doing changes directly in production for a limited time.
When i tried to run an SM20 report to list the actions I did but I get an empty result.Where as able to get other information except that particular user.
Findings:
1.Able to identify transaction used in st03 for that user.
2, logs were returned on that particular date.
3.cheked in sm19 all activities were active.
4.all related parameters were set accordingly.
PLease help me out in finding out the result and to solve the issue

> When i tried to run an SM20 report to list the actions I did but I get an empty result.Where as able to get other information except that particular user.
>
--> I believe you were able to view other users' activities during the same time, but specifically not for one user ?
In case there are many instances in your SAP system, could you check for all instances individually from SM20 ?
Also Security Audit logs cease to write when the audit log max size is achieved / quota for the day is done. Even this is instance specific and hence you need to verify this for the instance to which user logged on.
There are also occurances of Audit logs not being written owing to product error. Could you go through the following SAP Notes , in case the SAP release mentioned in the notes match with that of yours ?
SAP Note 763159 - Security Audit Log: some transaction starts not audited
SAP Note 710138 - Security Audit Log: Transactions are not recorded (3)
SAP Note 317883 - SecAudit: Transactions are not recorded
SAP Note 483953 - Security Audit Log: AU9 and AUA events are not recorded
SAP Note 840798 - SecAudit: Transaction code sometimes missing
cheers !
PRADi

Similar Messages

  • "Microsoft.Exchange.2010.Reports.Transport.Platform.TopUsers "Report show no result

    hello,
          i have an issue in my SCOM 2012 report.when i go to
    Reporting --> Exchange Server 2010 Report Library-->and open the report Microsoft.Exchange.2010.Reports.Transport.Platform.Top users.
    in my scom 2012 console and execute the report for top users on the basis of Messages Send or Messages Received ,it return zero result.
    thank you

    Hi,
    Blank reports can be a common issue with System Center Operations Manager. These are caused by many different reasons, and for the focus of this article we will discuss the following:
    1. The wrong type of entity was selected as the report target.
    2. The corresponding performance collection rule or the script that generates the performance data is not enabled for the report target.
    3. There is a functional problem with the Health Service on the agent.
    4. Management servers are unable to insert data into the OperationsManagerDW database.
    5. Data is stuck in the staging tables in the OperationsManagerDW database.
    More details:
    https://support2.microsoft.com/kb/2573329?wa=wsignin1.0
    In addition, it is suggested to configure the Exchange management pack  according to the mangement pack guide.
    And here are two links that should be helpful for you regarding to this issue, please refer to them:
    http://zoomindia111.wordpress.com/configure-exchange-2010-sp1-management-pack-in-scom-2007-r2/
    http://blogs.technet.com/b/emreguclu/archive/2011/09/26/empty-exchange-2010-server-statistics-mailflow-reports-if-default-log-directory-has-changed.aspx
    Regards,
    Yan Li
    Regards, Yan Li

  • Xl reporter shows different result before and after Period-End Closing.

    Hi SAP experts,
    We have an issue with XL Reporter. When we ran Period-End closing and ran XL - PL Period & YTD (with the same parameters), XLR shows nil in the Actual YTD column and the monthly figures are out by a big difference (example pre-rollover it was $110K after rollover it shows negative $12M).
    This happens on 2 different clients running 2 different SAP B1 (2007A PL 42 and 8.8 PL 13) on the same XL Reporter which is possibly the default XL report that comes with the installation.
    I don't have any idea why the XLR is running 2 different figures altogether when running the same XLR using the same parameter before and after rolling the year over. The default SAP B1 P&L report stays the same before and after the rollover, I would have expect that the same would happen with the XLR.
    Please advise.
    Regards,
    Didy Arfiono

    Hi Julie,
    Thanks for the reply. I'm not entirely sure what you mean by excluding a certain transaction for closing entries as this would defeat the whole purpose of PEC which as you stated was to transfer P&L balances to retained earnings account to be carried forward.
    I've check at some guides including one from Orchestra Team (http://www.youtube.com/watch?v=e4tUo774eXg) and so far the process that I've done is exactly what it is.
    Regards,
    Didy

  • Report value is showing empty ,

    Hi Gurus ,
    i have i added new keyfigure in to query & its showing in the report also
    But problem is the value of the keyfigure showing empty ,where as in the cube all values are 0.00
    i want the keyfigures values should be 0.00
    could any one help me out
    Berry

    Hi KP,
    thanks for u r reply , i was doing in Development, if i  made this chages as peer your direction surpress Zero,
    If it is transported to Production if the valus are like 5845 (example ), is it diplays 5845 are Zero
    Please let us know
    Thanks in advance
    Berry

  • On starting BI Server Report is showing 0 Result

    I have facing a strange problem.One report is showing 0 Result on starting server,checked back end query,it shows it is hitting some other fact,tht'why measure is not found and cast Null as 0 is happening.
    Strange thing is when I pull some other column from the same fact (But different Presentation table,same Logical table and Same LTS) along with my required measure it is showing data,hitting correct fact.But If I restart the server,again 0 result is coming.
    I disabled cache and restarted,still the issue is coming.
    I thought from BMM Layer the measure is not getting correct joins.
    So I check all logical and physical join with conformed dimensions with Logical Fact.All are ok.
    Measure has 2 definition at two LTS.
    1.CASE "Oracle Data Warehouse"."Catalog"."dbo"."Fact_W_ORDERITEM_F"."TOP_LVL_LN_FLG" WHEN 'Y' THEN "Oracle Data Warehouse"."Catalog"."dbo"."Fact_W_ORDERITEM_F"."ROW_WID" END
    2."Oracle Data Warehouse"."Catalog"."dbo"."Fact_W_ORDER_F"."NUM_ORDER_ITMS"
    Please suggest possible reason.
    Edited by: 980674 on Jan 8, 2013 9:04 PM
    Edited by: 980674 on Jan 9, 2013 7:12 AM

    Say the data is like this.
    Material Sold to Party Act Bud
    M1          S1               100   0
    M1          #                    0    50
    M1          S2               200   0
    And you want to see like below.
    Material Sold to Party Act Bud
    M1          S1               100   50
    M1          S2               200   50
    If this is your requirement, let the sold to party be in Rows.
    In columns, for budget, create a local selection, drag budget kf, sold to party (restrict this by # and right click and choose constant selection). This makes the budget kf independent of what is coming in the rows and always shows data corresponding to sold to party #. Hope this is clear.

  • System Center 2012 Cfg Mgr SP1 CU3 - Some Reports show blank box with no results (perhaps where a graphic would be)

    Just migrated from SCCM 2007 to SCCM 2012 SP1 CU3.  All seems to be working fairly well but when I run certain reports (especially in the EndPoint Protection) I get blank reports with a box where possibly a graphic should be shown.  No error given.  An
    example would be the report named "Antimalware overall status and history".  It just shows several boxes with perhaps a small picture icon in the top left of the box.    This occurs on several different reports.  But I do
    have results with other reports.  Any ideas?
    I am on sql server 2012 (64 bit) on windows 2012 std.

    Check these links Pls
    http://social.technet.microsoft.com/Forums/en-US/4479e73e-8a19-4c7e-9418-b36770656b9b/sccm-2012-reporting-point-server-instance-blank?forum=configmanagergeneral
    http://www.windows-noob.com/forums/index.php?/topic/5791-sccm-2012-rtm-reports-give-no-results-for-hdd-space/
    Thanks, Prabha G

  • Dont want to show overall result in my report

    Hi
    Probably quite simple,  i just dont fint how to " NOT show overall result in my query"

    if u have infoobject characteristics on columns, suppress results there also
    *helpful answers deserve some points*

  • Asset class does not show any results on the asset history sheet

    I have an asset that was acquired on 31.03.10. When I run the asset history sheet for all asset classes, it shows up(under the acquisition column). However, when I run the Asset History Sheet for only that one asset class, there are no results.
    Am I missing some config or is this a bug?
    Fixed Assets addon. SBO 2007A SP0, PL48.
    Financials >Fixed Assets > Asset History Sheet.
    Enter Asset class and Date: March 2010.Click OK.
    The report is empty.

    The problem was the asset class name. The character ' is not allowed and was not recognized by the asset history sheet report.

  • SM20 Reports

    Geetings,
    We run the SM20 audit log reports each month for DDIC activity when its associated with a terminal name. I understand best practice says to lock DDIC but because it is used for so many automated jobs the Basis group has not had the time to evaluate and simply pulling the plug could have downstream implications that they are affraid of. But I digress.
    We run this report for all audit classes/events and all security levels. In the output I get hundreds if not thousands of audit log messages related to the RFC call audit class within the "Severe and Critical" security level:
    RFC call Successful RFC Call BDL_DDIF_TABL_GET (Function Group = BDL5)
    RFC call Successful RFC Call SALC_UTIL_MT_GET_TREE_LOCAL (Function Group = SALC)
    RFC call Successful RFC Call /SDF/EWA_GET_PARAMETER (Function Group = /SDF/EWA)
    RFC Call RFC_PING (Function Group = SRFC)
    What are the security implications of these types of events? What is so Severe and Critical about these actions? I am trying to filter out as many meaningless or low security events to make the output somewhat reasonable otherwise I have thousands of records to sift through. How accurate is SAP in the assessment of these security levels? Are they being too conservative?
    I appreciate whatever guidance you can offer related to this.
    Thanks
    Mark

    Julius,
    I bow in deference to your knowledge of this area. It’s extremely helpful to
    get a thorough understanding on the nuances surrounding DDIC and SM20.
    Some background on me. I am an IT auditor and I inherited this process.
    Apparently way before I started here (4 years ago) this discussion must have come up
    as a result of SOX testing and the Basis group must have successfully defended
    against locking DDIC for the very same reasons you note. The IT Audit Director at the
    time understood the situation but PWC wanted some assurances that this activity
    was at least being reviewed and it became one of the ITGC’s to run the SM20 log
    report each month in each instance and have the Basis group review and sign off on all activity
    related to DDIC. If the SM20 output showed that DDIC signed in with reference to
    a terminal name or ip address they needed to explain why this was necessary.
    They were always able to explain the reasons behind this and the occurrences
    seemed minimal considering all the events logged related to that ID. Up until a
    few months ago I ran for all audit classes excluding user master changes with
    events of Severe and Critical.
    Fast forward to 2015 and PWC runs an independent SM20 report from our system
    and ran it for all audit classes and events = All. As you can imagine even for
    one month worth of activity the number of records was astronomical compared to
    running it the way I did. That was when I started taking a closer look at the
    log message text and the security levels associated. It didn’t make sense which
    brought me here.
    I will take you up on your offer to post a blog or wiki on the minimum
    authorizations required by user DDIC so that I can confirm we are truly looking
    at high risk events and filter out some of the noise to make this report
    readable and more accurate. It appears that we probably won’t be able to lock
    the ID and for valid reasons.
    PS
    Is there an OSS note or other governing document that refutes the security
    best practice of locking DDIC in production? Every SAP system security related manual
    I have read recommends locking this ID in production right after go live as if it’s one of those check the box and be done with it. It really is misleading to do this as you suggest as it could have
    greater implications that impact the business. Can I just tell the external auditors that you said it was ok?
    Thank you very much for your time.
    Regards,
    Mark

  • Show Empty Data

    I hope there is anybody how could help me:
    I create a Bex Query on EA Data (Account with same Key Figures) the Query is its based on a BPC Cube. In rows a only the account and in the columns are the key figures. Now not on all Account are values in the cube. I say in Bex Query that they should show Master Data. In Analyzer there are all accounts also the account without values in the cube.
    In crystal I only see account with values. I use CR SP3 and integration Kit SP3. I set u201CShowEmptyDatau201D to True but nothing happened.
    As second solution I create a formula in Bex with the value 1, take it in the columns but nothing happened in crystal I only see accounts with values in the cube.
    I donu2019t know what I could do.
    Second I had problems with the general connection of Bex and Crystal.
    In the normal way I create a new report with the Sap Integration Kit Menue. What is the different between this way and the way with the crystal function new report and use a new MDX Connection. In booth ways with the same SAP System I get different connection parameters. Which way is the right way.
    In addion if i set Show Empty Data to True, i get ask for the query variables and after it show empty data is set to false automaticly

    Hello Ingo,
    really??????
    But in release notes of SAP Integration KIT XI 3.1 SP3  SAP shows it as one of the big new features. I couldn't believe that this is a fake?? Thats was the basement why we use it.
    Is it in BO 4.0 possible to use only Crystal Reports Designer (which Version?) and a BW System with the Integration KIT?? Like in XI3.1??
    We only use Crystal Reports Designer with Integration KIT and the Integration KIT in the BW System. Is there an Integration KIT of BO 4.0 with transports for the BW System?
    I couldn't believe that it is not possible in XI 3.1. I stay in contact with the SAP and then im really angry because in the documnentation there is the option listed.

  • Ipod shows empty.

    Ipod shows empty, but space is still shown used. And everytime I connect my iPod, iTunes stops working. Please help.

    It could be an indication or a damaged or dying hard drive.  I would recommend doing a disk diagnostic on the iPod's HD using the instructions given by turingtest2 in this older thread.  He also covers what the resulting numbers indicate.
    https://discussions.apple.com/thread/3784647?start=0&tstart=0
    If necessary, post the resulting numbers and we can decide what the best course of action would be from there.
    B-rock

  • Report showing sum of Budget/actual cost of WBS elements from diff proj

    Hi,
    i need to display consolidated budget/cost report for separate projects. (example PROJ 1 and PROJ 2)
    in both projects, they have similar structure of WBS (same descriptions etc..)
    in reports i can run both project but the values are summarized for the entire projects.. (results = Total of PROJ 1 + total of PROJ 2).
    but i need report showing subtotals of WBS 1.1 of PROJ 1 + WBS 1.1 of PROJ 2 and so on...
    i thought i could do it using CJI8 but i cannot filter it by description and do subtotals since it does not have a description column.
    is my requirement possible with standard or need to customize a report?
    thanks in advance

    hi
    please try to use Co Object Name field with sub total

  • ODS and Infocube showing different results

    Hi,
    I loaded same data to Infocube and ODS but they are both showing different result in BEX.
    ODS
    ODS report is showing summarised values e.g
    vendor               order value                   invoice value        date
    00001                    20                               20                 01.01.2007
    Infocube
    result is showing not summarised values
    vendor               order value                   invoice value        date
    00001                    20                                 0                      0
                                  0                                20                  01.01.2007
    I would like to make the infocube result same as the ODS because I am remodelling so that we start reporting from Infocube rather than ODS.
    thanks

    Hi,
    this is the scenario
    currently we are reporting from ODS object which fetch data from 3 ODSes. now I am asked to remodel so that we can report from infocube not ODS.
    steps I have taken so far.
    - created new infocube
    - created 3 update rules ( same Update rules that gives the reporting ODS data).
    my target is to make sure that the current ODS  report is the same as the infocube report but so far the report is not consistent
    I compared the data in the ODS and infocube and they are exactly the same but the report is showing differently

  • I upgraged my macbook 2.4 GHz ram to 4g and now lower slot shows empty

    I have recently upgraged my ram to 4g and now the lower memory slot always shows empty.
    Any suggestions?

    I currently have 4gb in my core 2 duo (First Model) macbook. The last 700k is not recognized due to the internal design of the macbook, so the real "maximum" the computer sees is 3.3 gb. A web site published the speed gains with more memory, here is the web page for the results:
    http://eshop.macsales.com/Reviews/MacBook/Testing/Memory_Benchmarks
    4 Gigs of ram works great in my macbook, I noticed a huge speed increase even on boot, everything is much snappier than the original 1 gb.

  • I generate file (PDF, HTML, etc) the report is empty but I run in paper

    Hi
    I use oracle Report10g
    When I generate file (PDF, HTML, etc) the report is empty but I run in paper design show data, the report in the paper design show many pages, when generate file show only the information of the margin in the main seccion and the body is empty,
    Thanks

    Thanks Daniel for pointing that out.  Though you answer is helpful but I am not sure if that is what I would want to do.
    The link you provide for csv says "For each report there's an _report.xdo file that contains the XML structure of the report... "   It suggests I modify the .xdo file for each report.  I currently have 16 reports.
    Does it mean I modify the .xdo file for all 16  and what happens if someone creates a 17th report ?
    Also, what if I run the same report using different input parameters will that change the xml structure for the report  and therefore will need me to modify the .xdo again ? (I think it should not change the xml structure so the answer should be "NO" to that, unless I change the structure of the report).
    Finally, the link you provide says after doing what it suggest  "Now log back into BI publisher and select the report. You should now be able to see that CSV is now an option."
    CSV should be an option where ? on what screen/page ?  Maybe PDF is already an option for me that I cant see because I do not know where that option is.
    I was hoping there would be something I could do on the xdo_metadata sheet (in the data constraints section or elsewhere) OR in BI Publisher itself as some property of the report.
    I will try out what you suggest any ways.
    M. Jamal

Maybe you are looking for