SAP events and audit trails to external SysLog Server

[Former Member]

All,

looking for a solution to get SAP events and audit trails to an external SysLog (not the SAP Syslog) Server.

Actually I'm working on a PCI project where we would really like to have this information in one central place.

All other Systems and network components  are already "reporting" to the central syslog server.

Who has an idea on how to realize this?

Thank you in advance

Heiko

[mvoros]

Hi,

I don't think there is something that you can use out of the box. You can have a look how Solution manager collects data from the system and try to re-use that code. There is also nice project sapninja that allows you to export SAP monitoring data to Splunk. It's really interesting.

Cheers

[Former Member]

Hi,

thank you for the quick response.

I want to used it with Log and Event Manager from Solarwinds.

That should work almost the same way. I will set up an Project and Report.

Thank you

Heiko

[bxiv]

If you are using a Windows Server to run SAP, take a look at this software:  http://www.intersectalliance.com/projects/EpilogWindows/index.html

I have it performing the following for my own needs:  http://scn.sap.com/community/netweaver-administrator/blog/2013/06/20/notifications-upon-account-lock...

If you are running a Linux/Unix system, then you should be able to just forward the logs via the built in functions of the syslog application installed.

[Former Member]

Hi ,

did you ever implement a solution based on a Linux/Unix System?

This is the environment we (our custommer) are/is running SAP on.

If yes do you know what to define in the SM19/SM20 to write them to the right place?

Thank you

[bxiv]

SAP runs on Windows in my current environment, I noticed the "lock" syslog in the MMC and in the Windows Event log which lead me to Snare.

I have to assume that SAP is updating the syslog on the Linux/Unix system also, if you know which version/flavor of syslog is being used I probably know what needs to be configured to forward the logs to the SolarWinds system (which I also use to Admin back in my days of Network Operations )

Also are you looking to forward all logs are specific logs?  Also do you have a Solution Manager system in the landscape, as I have another method if you are looking to obtain specific syslog messages.

[Former Member]

This message was moderated.