Monitor SAP_ALL & SAP_NEW assignment to users

[Former Member]

Hello all,

We're trying to find a way to monitor the assignment of the SAP_ALL & SAP_NEW profiles to users in non-productive systems. The ultimate goal would be to use the security audit log in combination wit CCMS to monitor changes to the user master records.

However: it seems that the security audit log can monitor that a user master record (and thus the profile assignment) has been changed, but it appears that it does not provide information about what was changed (SAP_ALL / SAP_NEW)

Can anybody confirm that this just won't work or am I missing a parameter setting here?

Help would be greatly appreciated.

Best regards,

Jeroen.

Edited by: J. Keijzer on Apr 1, 2011 10:43 AM

[Former Member]

What you are looking for is report RSUSR100N with a variant for SAP_ALL assignments and removals which you schedule as a periodic background job with dynamic date calculation in a variant for it.

From SolMan you then only monitor the job itself.

Works like a charm when you send it to distribution lists as spool recipients or even ticketing systems.

Cheers,

Julius

[mvoros]

Hi,

I've never done this but another approach could be to write a custom auto reaction method for CCMS event. So you could simply check the current roles/profiles of modified user and send notification if necessary. FM SALO_EMAIL_IN_CASE_OF_ALERT_V2 is used to send an email. Your custom function will have same itnerface and you can just loop over events in table MT_TOOL_INFO and get rid of all unwanted changes and keep only relevant events. The last step is just to pass allremaining events to SALO_EMAIL_IN_CASE_OF_ALERT_V2.

Cheers

[Former Member]

Thanks for the reply, however: in this specific situation, use of the CUA for monitoring is not an option.

So we have to find a way to monitor the assignment of SAP_ALL & SAP_NEW, preferrably with the use os CCMS and without the CUA.

[Former Member]

Hello all

I am scheduling report RSUSR100N with variant for sap_all as a background job, the job output is sent out as an email. However it is sending out email even though there are no results. Is there a way to configure the job so that the email is sent out only when there is output?

Thanks