Help required regarding auditing users

[Former Member]

Hi ,

Can anyone help me on this.

When basis opens connection to allow changes in the production, we want to audit specific users what they are doing when connection is open.

I didn't find much options to do it.

I don't want to audit all users at that time, i just want to audit few users.

Can anyone suggest on this?

[Former Member]

From your message I am assuming that Security audit log -> Static configuration ( t-code SM19) is not maintained for all users.

You can still make use of Dynamic confoguration and if you have few users then you can activate the filter for those user id on separate filters. then make use of SM20 to display the Audit log.

RSAU/Selection_Slots is the paramter that controls number of filter. You can have max up to 10 filters.

[Former Member]

Hi Nishanth,

Do you mean to say that i need to create single dynamic filter for every user, in that case whether all dynamic filters will be active at a time.

Regards,

Rakesh.T

[Former Member]

The way I solve this is via a "user switch" to a personalized "emergency user" for an employee who is authorized to request access to it.

These users only add the additional authorizations required for the special task so are mostly useless on their own, but their names all come from the same name range and are in the same user group.

This gives you the option to activate the generic name option in the SM19 settings for these 'ZZEMERG*' user ID's regardless of the family names of the people whom you trust with such access, and without flooding the logs with boring information for 200k other users who have no critical access, etc.

If you go to RZ11 and enter RSAUGENERIC and hit F4 then read the documentation on the parameter for this logging part of the solution.

I also recommend increasing the available selection slots before you do anything else.

Cheers,

Julius

[Former Member]

>

> in that case whether all dynamic filters will be active at a time.
> 

This is true statement. Only one profile can be active at a time but all the filters within that profile will be active at the same time.

[Former Member]

Hi Julius,

I have one question for your reply, if we use emergency users when we see log we can only see that changes are done by emergency user only how come we know that particular change is done by particular user.

Regards,

Rakesh

[Former Member]

What most solutions do is that they log who reset the password of the emergency user and try to do this immediately before the password is used to logon (to prevent someone else from using the password instead).

There are a number of ways of doing this "user switch" - also without exposing the risk of a password and letting the emergency user determine who can call them and who cannot.

Cheers,

Julius