What controls the duration of data on FF Configuration Change Log?

[Former Member]

We are on GRC 5.3 SP 13.

What controls how long data remains on the FF Configuration Change Log?

How does data get removed from the FF Configuration Change Log?

I went to look at the Change Log today (02/29) in one of our SAP systems, but it only shows changes back to Monday (02/27). There should be several months of records out there.

Thanks.

[Former Member]

how often is your FF log collection Background job running? Also check for any failed scheduled jobs.

[simon_persin4]

do you have archiving switched on either through the standard FF auto archiving or a more SAP wider archiving solution?

You might find that the data is being cleansed and archived.

Simon

[Former Member]

We're having some confusion, so let me back up and try again.

I am referring the FF Configuration Change Log that you get to by going into FF, selecting the Tool Box, and then selecting Configuration Change Log. It tracks changes made to all of the FF tables (Controller, Owner, etc.).

We have FF in several of our SAP environments, and all are set up the same way. All environments have FF configuration changes dating back several months, except for one. This one used to have data going back that far, but now only has data going back a few days. Somehow data has been removed from it's FF change logs.

So, the question is what could have caused this data to now be missing for this one SAP environment? Did it roll off somehow or was it removed? How do I verify what happened, and prevent it from occurring again?

Our Auditors look at these change logs and are going to want to know what happened to this data.

Thanks.

[Former Member]

Hi again Bob!

As I said before, this is about table logging. Kindly refer to the note: [1263952 - Superuser Privilege Management Configuration Change Log|https://service.sap.com/sap/support/notes/1263952]

Cheers,

Diego.

[Former Member]

I had read your earlier posts and threads but they all seem to deal with how to turn the change log on for the FF tables. That is not what I am really asking about.

As I stated in my post on 3/1, this SAP system used to have configuration change logs for the FF tables dating back several months. Now it only has a few days worth.

What happened to all of the older data that used to be on these logs? How did it get removed?

Thanks.

[Former Member]

I think I may have found the answer. Using that SCU3 transaction referenced in your threads, I compared its results with the FF Configuration Change Log report and found some differences.

First thing I noticed is the the FF report does not include changes made by the userid assigned to the CUP/SAP connection. So if you have a CUP request that assigns a FFID to a user, the FF report will not show it, but it is on the SCU3 table.

Anyone have any idea why the FF report doesn't show those changes?

Second thing I noticed is that it looks like Basis has added an archive process for the change logs in this one system. Seems to archive anything over 90 days old. This appears to be the only system that has this archive process, but that would make sense since it's our most active R/3 system.

Thanks.

[Former Member]

Hello Bob!

There's a old discussion here:

I think that the ammount of data that you can view depends on the table logging for the specific tables mentioned here:

http://help.sap.com/saphelp_grcac53/helpdata/en/5a/12f8aa892c49d8a0a288420ae61421/frameset.htm

The table logging is described here: http://help.sap.com/SAPHELP_NW04S/helpdata/EN/c7/69bcd2f36611d3a6510000e835363f/frameset.htm

I think that the info. you're viewing now is from the STAD/STAT records. This records are deleted after some time depending on the configuration. Firefighter logs are fetched in the same way: Note 1290062 - How Firefighter picks up Change Log data (CLOG) for transact

but the difference here is that the job /VIRSA/ZVFATBAK saves the data before it gets deleted by the system.

Cheers,

Diego.