Performance issue of Security Audit log

[Former Member]

Hello,

My client would like to activate the Security Audit log on his system. However he will like to know whether there could be any performance issue when activating it. Since I do not have any prior experience, can you please give me your general feedback on this subject. Have any of you experience performance issue when implementing security audit log and what can be done to minimize its effect?

[Former Member]

Thank you Yoganand for your answer. Concerning the file size of the audit log, is there any mathematical model that can be use to simulate the file size and it's growth. My client will like to have an estimation of how big the file can get before implementing the system audit log.

[Former Member]

Hai,

There is no such mathematical model in SAP for Security Audit settings.

You can use the Profile parameters to define the size of the audit file.

Please find the profile parameters which controls the size of the audit file.

rsau/max_diskspace/local - Maximum space for security audit file

rsau/max_diskspace/per_day - Maximum size of all security audit files per day

rsau/max_diskspace/per_file - Maximum size of one single security audit file

You define the maximum size of the audit file in the profile parameter rsau/max_diskspace/local . The default is 1000000 bytes (= 1 MB). If the maximum size is reached, then the auditing process stops.

It depends upon your client, if they have more space in Filesystem and also if they are sure that they will either delete or archive the old audit files then you can configure the space generously.

Regards,

Yoganand.V

[Former Member]

Hai,

Activating Security Audit logs will not affect the performance of your SAP system. Since SAP Systems maintain their audit logs on a daily basis. The system does not delete or overwrite audit files from previous days; it keeps them until you manually delete them. Due to the amount of information that may accumulate, you should archive these files on a regular basis and delete the originals from the application server. This is the only thing you really need to take care since they might fill up the disk space if you dont archive or delete them on regular basis. Also since the data is very sensitive you should take extra care to protect the data.

Please follow the below links for more details.....

http://help.sap.com/saphelp_nw04/helpdata/EN/95/d2a8e36d6611d1a5700000e835363f/frameset.htm

http://www.saptechies.com/faq-answers-to-questions-about-the-security-audit-log/

Regards,

Yoganand.V