SM19 Security Audit Log Event Class

[Former Member]

All,

I am having a few logging problems. I would like to log the events of a user when the user accesses a particular tcode.

In SM19 for audit classes, there is something called event class. Is there a way where I can see what events in that class are considered "critical" or "severe" and can I add events to this class?

I'm asking because in SM19 there is no way that I can pass in a specific value to log for users in the system.

Please help

[Former Member]

T

>

 Is there a way where I can see what events in that class are considered "critical" or "severe" and can I add events to this class?

Click on the u201CDetailed Displayu201D or u201CDetailed Configurationu201D button in the Filter tabs.

Hope this helps.

PJ

[Former Member]

> ...and can I add events to this class?

The events are written in the kernel. You could try to find the tables via which these events are classed and add or change them, but that probably wont work anyway. If SAP permits something to be changed they provide a transaction or released interface for it.

> I'm asking because in SM19 there is no way that I can pass in a specific value to log for users in the system.

There is no such thing to my knowledge.

You need to log the data first, and then use SM20N selectively to report on it - in addition to the event classes, there are a number of filters and additional fields in the layout which you can use.

I use the audit log a lot and this meets my needs.

Specifically for logging selective transactions only, this is not of much use in my opinion... You will never find them all. Rather use the event of a failed transaction start (or other "entry point") and report on that.

[SAP Note 539404|https://service.sap.com/sap/support/notes/539404] would have helped you as well to some extent.

Cheers,

Julius

[Hank]

In sm19 log all user events, then by using sm20 or sm21 you are able to specific a user and a transaction.

sapsec-HB

Edited by: Henry Binning on Jun 4, 2009 9:49 PM

[Former Member]

Thanks for the info.

I will look into all replies listed.