not able to find who has accessed sap* user

Former Member · ‎10-09-2011

Hi Gurus,

Audit is going and am in critical situation please help me on this.

in production system sap* user id had logged with some body on july 27th 22:44:07 time but thing is due to some issue production was restarted with my id on 27th july 2011 22:43:51 time. so after restarting system immediatly some body has accessed sap* id but am not able to find who has accessed it.

Audit log is not activated and not able to find information in stad

please help me.

Thanks,

Venkat

Former Member · ‎10-09-2011

Try take a look in table PAHI... or the job log which executed the command.

Cheers,

Julius

Former Member · ‎10-10-2011

Hello Julius,

Thanks for replying

in the table PAHI am able to see parameter names then how can check there

which job log do i need to check and where?

Thanks,

Venkat

Former Member · ‎10-11-2011

Venkat,

Digging for Audits is a tough job as not everything will leave a trace or a log... but a small trick that helps me at times to trace terminals is as below.

ST03 (Admin View) --> User Analysis --> Sort to get the user you would like to see --> Double click it and it would give you the list of tcodes executed by the user in that period --> Place your cursor on one of the report/transaction and click Single records --> It takes us to Workload data with server names --> Click F9 and you would see the selection options. Deselect CPU Time, Wait time etc and select Terminal at the end.

This should provide the time, tcode and the terminal for a particular user on that time.

The down side of this is a lot of Data is pulled from STAD and further details are dependent on Basis settings. You might want to give this method a try . Hope it helps..

~Sri