User Audit and Security log

[Former Member]

Hello Experts,

We are using an ECC 6.0 systems. My question is apart form SM19 is there any other t_code to trace the user action that is a more detail trace on user action.

As you know SM19 settings will offer us the basic action of user that is what t_code or reports are being used by user. But I want to know what are they doing there that is they are trying to access some infortype in t_code like PA30 or they made in table definition change in SE16 like that.

Please let me know about this.

Thanks in advance.

Regards,

Partha

[Former Member]

Hi Partha,

If you know what you are looking for you may use the change document tables, CDHDR and CDPOS they should provide you with some info.

Best Wishes,

CP

[Former Member]

Hi Chinmoy,

Can you tell me how to access those tables mentioned by you and how to analyze the contains

Regards

Partha

[Former Member]

> Can you tell me how to access those tables mentioned by you and how to analyze the contains

You access this like any other table using SE16. check for its contents on the basis of your requirments.

Regards,

CP

[Former Member]

Go to Transaction ST05

Click on Trace on

And when you need the trace for the user activities just go to the Transaction ST05

Click on Trace off

Go to the User Trace Directory

/usr/sap/PRD/DVEBMGS00/log/TRACE000.LOG

You will get the user activities

[fredrik_borlie]

Have a look at the STAD transaction!

http://help.sap.com/saphelp_nw70/helpdata/EN/d7/7de93a2176a418e10000000a11402f/frameset.htm

However this data is aggregated on hourly/daily/weekly basis. So detailed information might not be available after some time.

Depending on what you want to trace you can also look at the GRC tools available from several vendors.

SAP Have its own tool:

http://www.sap.com/solutions/sapbusinessobjects/large/governance-risk-compliance/index.epx

Good luck!

/fredrik

[sdipanjan]

Hi Partha,

You can use the following TCodes also.

1. STAD

2. STAT

STAD and STAT can also be navigated from ST03N. If you want to log a particular TCode (for e.g. PA30), then please follow the below steps:

Go to ST03N -> Expert user mode -> Collector & Performance DB -> Workload collector -> Parameters.

Enter the transaction codes for the transactions to be analyzed in detail in the Create transaction detail profiles for group box. Save your changes. (please read the message carefully in this screen).

3. STATTRACE

4. SM21

If you are in SM21, then please select all the options in "Settings" radio button. After getting the display of Log screen, you can further analyze a message in more details by double clicking it.

Still SM20 is really a good choice to view user actions.

Please re-check (in SM19) that all the Audit Classes are selected for the current filter you are analyzing. Before reading the audit log make sure to include all Instances (telling this, just to be sure).

Mark all in "Events" and "Statistic" tabs. Now display the data selecting the particular user and tcode.

Hope this discussion may help you to some extent. Please let me know for any more query.

Regards,

Dipanjan

[Former Member]

Take a look at the FAQ sticky thread at the top of the forum page...

Generally, if you can imagine that a question has been asked before, then you will find many answers via the search and the FAQ.

Do you have a special requirement or doubt which is not covered yet after a reasonable search?

Cheers,

Julius

[Former Member]

Resolved by activationg ST01.

Thanks,

Partha