How to find out from whcih terminal user tried logging in and failed

[Former Member]

Hello All,

One of the user is trying to login using master userid (SAP* / DDIC).. But he is failing after three attempts resulting in locking the SAP* / DDIC user id.

We are unable to trace who is attempting this? If we know from which terminal user is trying to login we can find out the person.

Even in SM21 we are unable to see from which terminal user is trying to login..(We can see the terminal clearly in SM04). Could you please suggest us how to trace the person responsible for this issue?

Thanks,

Subbu

[Former Member]

Hi,

The terminal details can be obtained through securiy audit logging.

You can enable to Security logging for the users SAP*/DDIC using the tcode SM19 and the logs can be viewed using the tcode SM20.

To to activate the security audit logging you need to set the value '1' for the parameter rsau/enable. The log file size can be set using the parameter rsau/max_diskspace/local. You can set the number of slots to be used for security auditing purpose using the profile parameter rsau/selection_slots in the default profile.

Hope this information helps.

Regards,

Varadhu