SUIM security-audit checklist....

hello, i found a check list SAP security-auditing in SUIM. i searched some of them in internet but my mind confused.
i think it can be very helpful checklist for people working in SAP security-auditing.
if you have time, can you tell me please what these reports mean? with 1-2 sentences.
( i know they are a bit much but i think it can be realy good source for people wants to work in SAP security- auditing like me.)
Thank you very much
Regards..
SUIM--->>>>
1)  S_TCODE = SM36,Authorization Object 1: S_BTCH_ADM = Y; Authorization Object 2: S_BTCH_JOB = * for Job Operations and * for Summary of jobs for a group; Additional selection criteria – Unlocked users only
2)  S_TCODE = SM37; Authorization Object 1: S_BTCH_JOB JOBACTION = *; Additional selection criteria – Unlocked users only
3)  S_TCODE = SM35; Authorization Object 2: S_BDC_MON1=*, Additional selection criteria – Unlocked users only
4)  S_TCODE = SE18; Additional selection criteria – Unlocked users only
5)  S_TCODE = SE19; Additional selection criteria – Unlocked users only
6)  S_TCODE = SM69; Authorization Object 1: S_RZL_ADM= 01; Additional selection criteria – Unlocked users only
7)  S_TCODE =SM49; Authorization object1: S_LOG_COM, COMMAND Value: #*; POSYSTEM Value: #*; R/3 Value: #* additional selection criteria: unlocked users only
8)  Authorization object 1: S_RFC; RFC_TYPE: FUGR; RFC_NAME: #*; activity: 08; additional selection criteria: unlocked users only
9)  S_TCODE = SECR;” “authorization object1: S_IMG_ACTV, Project no: 900; ACTVT = 02; IMG Value = #*” “authorization object2: S_PRO_AUTH Project no: 900 ACTVT: 03” “additional selection criteria: unlocked users only
10)  S_TCODE=SU01: Additional selection criteria – Unlocked users only
11)  S_TCODE=SU01; 2: Authorization object 1: S_USER_AUT; ACTVT Value=03 or 08” Additional selection criteria – Unlocked users only
12)  S_TCODE=SU02; Additional selection criteria – Unlocked users only
13)  S_TCODE=SU03; Additional selection criteria – Unlocked users only
14)  S_TCODE=SU10; Additional selection criteria – Unlocked users only
15)  S_TCODE=RZ10; Authorization object 1: S_DATASET, ACTVT Value = *; Authorization object 2: S_RZL_ADM ACTVT Value = 01 or 03; Additional selection criteria – Unlocked users only.
16)  S_TCODE =SE16; Authorization object1: S_TABU_DIS, Authorization group = SC, ACTVT =02; Additional selection criteria: unlocked users only
17)  S_TCODE = SNRO; authorization object1: S_NUMBER, Value = #*, ACTVT = 01, 02, 11; 3: Additional selection criteria – Unlocked users only
18)  S_TCODE = SCC4; authorization object1: S_TABU_DIS Table Maintenance (via standard tools such as SM30), ACTVT = 01, 02, 03; authorization group = SS; Additional selection criteria – Unlocked users only
19)  Authorization object 1:S_ADMI_FCD, Value: SP01 or SPOR; authorization object 2: S_SPO_ACT Value = ATTR (change attributes of protected spool request) or BASE (see protected spool requests in the output controller [determine whether the spool request exists], display request attributes) and DELE (delete request manually) or REPR (output protected spool request more than once); authorization object 3: S_TMS_ACT (Actions on TemSe objects); STMSOWNER Value  = GRP (external TemSe objects in own) or OWN (own TemSe objects) authorization object 3 = S_TMS_ACT: Additional selection criteria – Unlocked users only
20)  S_TCODE = SCCL; authorization object 1: S_CLNT_IMP, Activity = 21, 60; authorization object 2: S_TABU_CLI, Cross Client Indicator = #*; Additional selection criteria – Unlocked users only
21)  S_TCODE = SCCL; authorization object 1: S_CLNT_IMP, Activity = 21, 60; authorization object 2: S_TABU_CLI, Cross Client Indicator = #*; Additional selection criteria – Unlocked users only
22)  S_TCODE =SM31;” “authorization object 1: S_TABU_DIS, ACTVY =01,” authorization object 2:  “S_TABU_CLI CLIIDMAINT =x”: “additional selection criteria: unlocked users only
23)  S_TCODE =SM30;” “authorization object 1: S_TABU_DIS, ACTVY =01 or ACTVY =02,” authorization object 2:  “S_TCODE =S_TABU_CLI, CLIIDMAINT =x”: “additional selection criteria: unlocked users only
24)  Authorization object 1: “S_TCODE =SA38 or SE38;” “2: authorization object S_PROGRAM Value =SUBMIT: “additional selection criteria: unlocked users only
25)  S_TCODE =SA38 or SE38;” “2: authorization object S_PROGRAM Value =SUBMIT: “additional selection criteria: unlocked users only.
26)  Authorization object 1: S_TRANSPRT Value = 43
27)  S_TCODE = SE01; authorization object 1: S_TRANSPRT Value:1, 2; authorization object 2: S_DATASET Actvt: 06,33,34
28)  S_TCODE = SE03; authorization object 1: S_TRANSPRT Value: 06,43 ; authorization object 2: S_CTS_ADMI Value: TABL
29)  S_TCODE = SE10; authorization object 1: S_TRANSPRT Value: 01, 02; authorization object 2: S_DATASET Value: 06, 33, 34.
30)  S_TCODE = SCC4; authorization object 1: S_CLNT_IMP Value: 21, 60: Additional selection criteria – Unlocked users only
31)  S_TCODE: SM12; authorization object 1: S_C_FUNCT Value = *; activity value = 16; authorization object 2: S_ENQUE; S_ENQ_ACT Value = *.

i want to learn what all these authorization objetcs stand for. 1,2,3,4... because each one asks a different report..
for example, lets talk about first one.
1)  SUIM---->   S_TCODE = SM36,Authorization Object 1: S_BTCH_ADM = Y; Authorization Object 2: S_BTCH_JOB = * for Job Operations and * for Summary of jobs for a group; Additional selection criteria – Unlocked users only
in this report. why does it ask this? what does it mean to to choose S_BTCH_ADM to Y ,S_BTCH_JOB, to * and choosing ..or Job Operations and * for Summary of jobs for a group; Additional selection criteria – Unlocked users only..
i wonder this. why is this report it important and what does it ask?
Thank you for your messages.

Similar Messages

  • 10G RAC security auditing

    Hi,
    I was asked to prepare a database security audit in my company. The target system is 10G RAC configuration with two nodes. What should my checklist contain? Which elements of the system must I verify?
    On Oracle's web pages I've found the following document:
    http://www.oracle.com/technology/deploy/security/pdf/twp_security_checklist_db_database.pdf
    Is it enough? Can you advice me? Any help will be appreciated.
    Regards,
    Tim

    Hi,
    What is the purpose of this audit? Do you have any criteria? Or are you allowed to make up your own list?
    My experience is databases hosting third party apps are usually completely unprotected because
    - the application owner has the connect, resource and dba roles (or even more)
    - the account has the password set to the user name.
    Also if an application is not using bind variables, the system is sensitive to 'SQL injection'.
    The document you posted outlines some basic measures, but it doesn't go into sufficient detail. It doesn't mention the password_verify function you can set up. It doesn't mention system privileges at all. It doesn't mention you should disallow telnet access, and disallow root to login remotely (ie one should su to root).
    Etc, etc.
    There is a whitepaper on OTN called 'Project Lockdown' written by Arup Nanda. It implements 3 or 4 times more measures.
    Sybrand Bakker
    Senior Oracle DBA

  • How to schedule a batch job to generate security audit log (SM20)

    May be this is a repeat question for this forum. Apologize, if it is. Is there a way to schedule a batch job to generate security audit log (SM20) automatically and possibly send a message to SAP Inbox or generate a spool request? Release is 4.6C.
    Regards
    Nirmal

    > May be this is a repeat question for this forum. Apologize, if it is.
    You don't need to apologize. You only need to do a very simple search...
    > Total Questions:  18 (16 unresolved) 
    Perhaps 16 of those 18 questions you have not followed up on could have been spared as well?
    Please do the needfull.
    Cheers,
    Julius

  • Multiple security audit failures a second

    A client's SBS 2011 machine is experiencing multiple audit failures a second and we believe it is diminishing the performance of the machine. We can't seem to find the source or how to remedy the issue. It its happening way too fast to be a human trying
    to login. 
    Keywords Date and Time Source Event ID Task Category
    Audit Success 6/18/2014 1:50:32 PM Microsoft-Windows-Security-Auditing 4905 Audit Policy Change "An attempt was made to unregister a security event source.
    Subject
    Security ID: SYSTEM
    Account Name: SBS$
    Account Domain: <ommited from forum post>
    Logon ID: 0x3e7
    Process:
    Process ID: 0x10d4
    Process Name: C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
    Event Source:
    Source Name: ServiceModel 4.0.0.0
    Event Source ID: 0x262070f0"
    Audit Success 6/18/2014 1:50:32 PM Microsoft-Windows-Security-Auditing 4904 Audit Policy Change "An attempt was made to register a security event source.
    Subject :
    Security ID: SYSTEM
    Account Name: SBS$
    Account Domain: < ommited from forum post >
    Logon ID: 0x3e7
    Process:
    Process ID: 0x10d4
    Process Name: C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
    Event Source:
    Source Name: ServiceModel 4.0.0.0
    Event Source ID: 0x262070f0"
    Audit Failure 6/18/2014 1:50:32 PM Microsoft-Windows-Security-Auditing 4625 Logon "An account failed to log on.
    Subject:
    Security ID: SYSTEM
    Account Name: SBS$
    Account Domain: <ommited from forum post>
    Logon ID: 0x3e7
    Logon Type: 3
    Account For Which Logon Failed:
    Security ID: NULL SID
    Account Name:
    Account Domain:
    Failure Information:
    Failure Reason: Unknown user name or bad password.
    Status: 0xc000006d
    Sub Status: 0xc0000064
    Process Information:
    Caller Process ID: 0x24c
    Caller Process Name: C:\Windows\System32\lsass.exe
    Network Information:
    Workstation Name: SBS
    Source Network Address: -
    Source Port: -
    Detailed Authentication Information:
    Logon Process: Schannel
    Authentication Package: Kerberos
    Transited Services: -
    Package Name (NTLM only): -
    Key Length: 0
    Subject
    Security ID:
    SYSTEM
    Account Name:
    SBS$
    Account Domain:
    <ommited from forum post>
    Logon ID:
    0x3e7
    Process:
    Process ID:
    0x131c
    Process Name:
    C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
    Event Source:
    Source Name:
    ServiceModel 4.0.0.0
    Event Source ID:
    0x26206ef4"
    Audit Success 6/18/2014 1:50:32 PM
    Microsoft-Windows-Security-Auditing
    4904 Audit Policy Change
    "An attempt was made to register a security event source.
    Subject :
    Security ID:
    SYSTEM
    Account Name:
    SBS$
    Account Domain:
    <ommited from forum post>
    Logon ID:
    0x3e7
    Process:
    Process ID:
    0x131c
    Process Name:
    C:\Program Files\Windows Server\Bin\SharedServiceHost.exe
    Event Source:
    Source Name:
    ServiceModel 4.0.0.0
    Event Source ID:
    0x26206ef4"
    Audit Failure 6/18/2014 1:50:32 PM
    Microsoft-Windows-Security-Auditing
    4625 Logon
    "An account failed to log on.
    Subject:
    Security ID:
    SYSTEM
    Account Name:
    SBS$
    Account Domain:
    <ommited from forum post>
    Logon ID:
    0x3e7
    Logon Type: 3
    Account For Which Logon Failed:
    Security ID:
    NULL SID
    Account Name:
    Account Domain:
    Failure Information:
    Failure Reason:
    Unknown user name or bad password.
    Status:
    0xc000006d
    Sub Status:
    0xc0000064
    Process Information:
    Caller Process ID:
    0x24c
    Caller Process Name:
    C:\Windows\System32\lsass.exe
    Network Information:
    Workstation Name:
    SBS
    Source Network Address:
    Source Port:
    Detailed Authentication Information:
    Logon Process:
    Schannel
    Authentication Package:
    Kerberos
    Transited Services:
    Package Name (NTLM only):
    Key Length:
    0
    Jerry T

    Hi Jerry,
    Windows logs logon type 3 in most cases when you access a computer from elsewhere on the network. This is usually
    related to share folders, printers, IIS and so on.
    Would you please let me confirm whether you had installed some third-party applications?
    Meanwhile, please refer to Robert’s suggestion in the following similar thread and check if can help you.
    Audit
    Failure - Event 4625
    If any update, please feel free to let me know.
    Hope this helps.
    Best regards,
    Justin Gu

  • "logon time" between USR41 and security audit log

    Dear colleagues,
    I got a following question from customer for security audit reason.
    > 'Logon date' and 'Logon time' values stored in table  USR41 are exactly same as
    > logon history of Security Audit Log(Tr-cd:SM20)?
    Table:USR41 saves 'logon date' and 'logon time' when user logs on to SAP System from SAP GUI.
    And the Security Audit Log(Tr-cd:SM20) can save user's logon history;
    at the time when user logged on, the security audit log is recorded .
    I tried to check SAP GUI logon program:SAPMSYST several ways, however,
    I could not check it because the program is protected even for read access.
    I want to know about specification of "logon time" between USR41 and security audit log,
    or about how to look into the program:SAPMSYST and debug it.
    Thank you.
    Best Regards.

    Hi,
    If you configure Security Audit you can achieve your goals...
    1-Audit the employees how access the screens, tables, data...etc
    Answer : Option 1 & 3
    2-Audit all changes by all users to the data
    Answer : Option 1 & 3
    3-Keep the data up to one month
    Answer: No such settings, but you can define maximum log size.
    4-Log retention period can be defined.
    Answer: No !.. but you can define maximum log size.
    SM19/SM20 Options:
    1-Dialog logon
    You can check how many users logged in and at what time
    2-RFC login/call
    Same as above you can check RFC logins
    3-Transaction/report start
    You can see which report or transaction are executed and at what time
    (It will help you to analyise unauthorized data change. Transactions/report can give you an idea, what data has been changed. So you can see who changed the data)
    4-User master change
    (You can see user master changes log with this option)
    5-System/Other events
    (System error can be logged using this option)
    Hope, it clear the things...
    Regards.
    Rajesh Narkhede

  • Getting the name of the program or the FM called from security audit log

    Dears,
    Is there a way to get the name of the ABAP program called through transaction SE38, or the FM called through transaction SE37, from the security audit log ?
    What is available is only : RSABAPPROGRAM for transaction SE38, and RSFUNCTIONBUILDER for transaction SE37
    Thanks.
    Reda

    I had always assumed this log to be in the SUBMIT statement, but never used it.
    If I remember correctly this is recorded it the runtime submit, so it should be there.
    Perhaps it is only in selected reports? I will check in my system.
    Please compare with sm20n and run the report from sa38. The submits are different in sa38 etc compared to se38.
    The FM will only be recorded it it has a destination extention in the source system which is mostly remote. Local fm calls are not recorded for sure.
    Cheers,
    Julius
    Edited by: Julius Bussche on Jul 26, 2011 11:32 PM

  • Solaris 10 with Trusted Extensions - Security Audit Events [short] Descript

    {color:#000000}I know that the security audit events and classes in Solaris 10 have changed when viewing these files: audit_class, audit_event, and audit_control with that of the same files for TSOL8. In order to perform an accurate and acceptable review of the audit events, I need to find either a file or document that provides a short description for each of the audit events within each audit class. Can anyone point me in the right direction or a URL? I have tried to search through the Sun docs and have not yielded any results. {color}

    been there, done that
    The problem is a function of your network definitions. The non-global zones do not have an IP address to match for your global zonename. The error message results from the system established default of the DISPLAY variable failing (DISPLAY=globalzonename:0.0).
    To confirm this, login to the global zone as root and "zlogin -S" to the non-global zone. Once there, the command "netstat -r" should show the IP address of the global zone instead of the expected global zonename. (combine this with a look at your output for "ifconfig -a" within the same non-global zones) Another command you should fail with will be the "getent hosts galaxy". Anyway, if you manually set your DISPLAY variable to the "IP Address" of the globalzonename and execute a "dtterm" ... it should work fine.
    If it does not violate a security policy, I suggest you add the IP address of the global zone to either the /etc/inet/hosts or /etc/inet/ipnodes file within each non-global zone.

  • Consultancy Services for RAC installation and  Internet Security Audit

    Dear All,
    "Warm greetings from Venkatesh"
    We are proud to announce that, we have started a leading Database, Networking and Internet security Consulting organization at PUNE with a global presence through which we offers a focused, Excellence Solutions for Database, Networking and internet security for vulnerabilities and ethical hacking to the organizations to achieve a sustainable performance and results, and to contribute to the delivery of Quality Product, Solutions and Services to transform the human lives every day.
    We offer a customized Consulting and Corporate Training Services at competitive sizes of organization in all major verticals for Performance Excellence as under with six months maintenance support after RAC installation
    Design and Implementation of Oracle RAC (Real Application Cluster)
    - Oracle solution for High Availability & Grid Computing
    - Versions: Oracle 10gR2, 11gR1 & 11gR2
    - Operating System: Linux, Windows, Solaris, AIX
    - Storage: ASM, OCFS2
    - ASM Cluster File System (ACFS) in Oracle 11gR2
    - Building RAC setup in VMware Environment
    - Feature: Load Balancing, Failover, Dynamic addition of Nodes to Grid
    Design and Implementation of Oracle Data Guard
    - Oracle solution for Disaster Management
    - Primary & Secondary Sites
    - Logical & Physical Standby Database
    Internet Security Audit for Vulnerabilities and Ethical Hacking
    - Penetration testing
    - Source code audit
    - Information security training
    - Website design and development
    - Data Centre audit
    - ISO 27701 consultancy
    We also offer Corporate Trainings for
    - Oracle RAC Administration
    - Automatic Storage Management (ASM)
    - Data Guard
    Please feel free to revert back for any queries.
    Regards
    Venkatesh
    mail: [email protected]
    Edited by: vjpune on Apr 17, 2010 4:44 AM

    Hi! keyur,
    Greetings from venkatesh
    Sorry for delay, i was busy with some assignments.
    Actually, we are consultancy service provider for those organization who needs to Install Oracle RAC server. We provide entire services i.e. from designing to implementation of RAC server, provide solution for load balancing, desaster management and so on.. what i had mention in the earlier post.
    Also we offer corporate training to the organization in RAC administration, ASM, Data Guard.
    I think this info will get you to understand our services..
    we welcome inquires if any from your end.
    Regards
    Venkatesh
    mail: [email protected]

  • In which table can I find security audit settings from SM19?

    Hello everybody,
    I'd like to give certain users access to the security audit settings that we defined in SM19. They are supposed to be able to read them but not change anything. I've experimented a bit with SM19 authorizations and figured out that a read-only access to SM19 is possible if I deactivate S_C_FUNCT. The problem is that the aforementioned users already have complete access to S_C_FUNCT and are supposed to keep it. The also have AUDD and AUDA in S_ADMI_FCD. Ergo: If I just add the S_TCODE for SM19 they'd be able to change security audit settings and I don't want to allow that.
    Does anybody know the table where SM19 saves its settings? Maybe I could grant read-only access to that table via SM30 or SE16...
    Looking forward to your answers!
    Kind regards
    Mario

    Hi Mario,
    Restrict  access for table RSAUPROF , It should do!!!
    Regards

  • CCMS and Security Audit log

    I have seen a huge number of companies who do not use SM19/SM20 or RZ20. It is not configured. example I worked for 3 clients(user base 14000, 16000,1000) and none of them have this configuration.
    Do you know why is it so if it is not configured at your place.
    Thanks
    Edited by: Pankaj Jain on Sep 26, 2009 7:02 PM

    Performance impact is dependent on the Hardware sizing and the daily monitoring activities together with the back up schedule by the BASIS team.
    My experience is: I have seen maximum of clients using this for logging activities of ALL users in the system. In other few cases, it is restricted to Super and Special users.
    Please go through the document: [Security Audit Log|http://www.sdn.sap.com/irj/scn/index?rid=/library/uuid/2088d9d4-e011-2a10-bba9-90548dbc2d6a&overridelayout=true] (it's a bit Old)
    Try searching Community with SM20 / SM19 / Security Audit Log search strings.
    Regards,
    Dipanjan

  • SM19 security audit maximum file size is 100MB ?

    Dear all,
    My system security audit log has reached maximum 100MB.
    a.) Is 100MB the default size ?
    b.) Any way to increase it ?
    Comment and advice will be appreciated.
    Thanks.
    Regards,
    Kent

    Hi,
    > a.) Is 100MB the default size ?
    Yes
    > b.) Any way to increase it ?
    >
    Follow SAP note 909734.
    Also link: http://www.saptechies.com/faq-answers-to-questions-about-the-security-audit-log_1/
    Thanks
    Sunny

  • Security Audit Log SM19 and Log Management external tool

    Hi all,
    we are connecting a SAP ECC system with a third part product for log management.
    Our SAP system is composed by many application servers.
    We have connected the external tool with the SAP central system.
    The external product gathers data from SAP Security Audit Log (SM19/SM20).
    The problem is that we see, in the external tool,  only the data available in the central system.
    The mandatory parameters have been activated and the system has been restarted.
    The strategy of SAP Security Audit Log is to create many audit log file for each application server. Probably, only when SM20 is started, all audit files from all application servers are read and collected.
    In our scenario, we do not use SM20 since we want read the collected data in the external tool.
    Is there a job to be scheduled (or something else) in order to have all Security Audit Log available (from all application servers) in the central instance ?
    Thanks in advance.
    Andrea Cavalleri

    I am always amazed at these questions...
    For one, SAP provides an example report ( RSAU_READ_AUDITLOG_EXTERNAL ) to use BAPIs for alerts from the audit log yet 3rd party solutions seem to be alergic to using APIs for some reason.
    However, mainly I do not understand why people don't use the CCMS (tcode RZ20) security templates and monitor the log centrally from SolMan. You can do a million cool things in SolMan... but no...
    Cheers,
    Julius

  • Weu0092d like to get Custom reports. The base of reports is Security Audit Log

    We’d like to get Custom reports. The base of reports is Security Audit Log files. This is files for SM20.
    What does the file structure look like? What is field of it?
    Thanks!

    Hello Marina
    The data written to the security audit log correspond to the DDIC structures RSLGENTR (up to release 4.6) and RSAUENTR2 (in newer releases). DDIC structures can be viewed using TA SE11 (data type).
    As I can see you have already opened a thread regarding this. Please don't duplicate the threads, as this only widespreads the information.
    Regards,
    Désiré

  • Security Audit Log for XI IB

    Hello,
    on the ABAP Stack it is possible to activate the security audit log, to log activities on certain objects/functions. Is there also a possibilty to do this for the JAVA-Stack.
    We have for legal reasons to log, want users are doing on the productive XI system. E.g. we wanna log if someone is changing the value mapping or configurating the adapter.
    Regards, Werner

    Hi,
    chk out these links
    Audit Log
    http://help.sap.com/saphelp_me21sp2/helpdata/en/23/c9833b3bb1780fe10000000a11402f/content.htm
    regards
    jithesh

  • Security audit log for the last 30 days?

    Hi,
    My current settings for the security audit log is 20 MB (by default).  I dont want to control it with file size limitation, but by the no. of days the audit is recorded (max 30 days).
    What are the parameters that I would need to maintain?
    Or any additinal config is required?
    Thanks,
    Abdul

    Hi,
    My current configuration is like this:
    Name                Description                                           Current value                                            System default value
    FN_AUDIT     Name of security audit file          audit_++++++++
    DIR_AUDIT     Directory for security audit files     /usr/sap/GSP/DVEBMGS00/log     /usr/sap/GSP/D00/log
    rsau/enable     Enable Security Audit          0
    rsau/max_diskspace/local     Maximum space for security audit file     300M     20M
    rsau/max_diskspace/per_day     Maximum size of all security audit files per day          0
    rsau/max_diskspace/per_file     Maximum size of one single security audit file          0
    rsau/selection_slots     Number of selection slots for security audit          2
    rsau/user_selection     Defines the user selection method used inside kernel functions          0
    I have just activated the audit, and in just 30 minutes, I can see that the file is about 45MB.  If this is the growth rate, the 300MB allocated for audit will completely used in just a day.
    My requirement is - I want to track users and their activities for the last 30 days (or 45 days).  No log should be overwritten unless it is atleast 30 days old.
    In SM20, when I give selection from 1.1.10 to 31.1.10, it should show me all the activities during this period, without any breaks.
    Other doubts: Do I have to start auditing manually every day?  Or will it keep writing logs until it reaches 300 MB which can spread upto multiple days.
    Regards
    Abdul
    Edited by: Abdul Rahim Shaik on Feb 4, 2010 11:17 AM

Maybe you are looking for

  • What has happend to Adobe Media Encoder in CS4?

    I have been making short (5min to 10min) movies for the web for several years. I have used Premiere Pro CS3 and exported to FLV using the CS3 Adobe Media Encoder. The results have been excellent using 800kb/s at 25fps. I then upgraded to Premiere Pro

  • How to use  third party package in java application

    hi, i am a student , new to java world can any of u tell me how to import third party package in our java application. i want to know how CLI is done in java. i am going thru this link http://www.codezoo.com/pub/component/5574 not able to get anythin

  • Landline cancelled without customer's consent or r...

    BT has shown initiative and cancelled my landline without my consent! I am moving house next week and my landline is the conact numbers for movers, decorators, builders, etc and it is nothing short of disastrous. I am also in trouble with O2 now as i

  • Getting 0Analysis_Pattern_Info to work

    Hi there What do I need to do in order to get the standard template 0Analysis_Pattern_Info to work? This template is called when the Information button is clicked, but at the moment all I am getting is a short dump error message. Cheers, Andrew

  • How to design Distributed transaction?

    Hi I have distributed transaction that involve MQ and two oracle database. In both database I have stroed procedure that have their own rollback points. My requirement is that either both database shoulb committed or none. For this to implement I hav