User Activity History without using STAD

[Former Member]

Dear Security Experts,

For some detective work involving facts and fiction, I would like to know if there are any t-tables where user activity - last log in, log out, programs and transactions accessed etc is logged by the system. At this point I don't know if trace has been activated for user activity and if so logs are deleted periodically.

I am just fancying some presence of hidden tables where such info might be stored internally forever. I have an intuition that they are :-).

Thanks

Borat.

[ACE-SAP]

Hi

You can use Security Audit Log to trace user activities (login, transaction used, report launched...).

http://help.sap.com/saphelp_nw73ehp1/helpdata/en/c7/69bcb7f36611d3a6510000e835363f/frameset.htm

There are some basic instance parameter to set, then you can define what you want to track using SM19 and read the trace with SM20.

These trace are store in flat files.

Depending on your needs you might also get information from table history (SCU3) if instance parameter rec/client is set you can have a trace of changes on tables that are set with the "Log Data Changes" option by default set on most of the customizing tables).

http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4d/b6ceab36311dcee10000000a42189c/content.htm?frame...

This information is stored in table DBTABLOG,

For application tables you can also check change documents.

http://help.sap.com/saphelp_nw73ehp1/helpdata/en/48/dfd831ab21280ce10000000a42189c/content.htm?frame...

This information is stored in tables CDHDR & CDPOS,

Regards

[Former Member]

Thank you Yves,

Second and third options of logs of customizing and application table and field changes could have been useful but I saw change logs are either not activated or probably deleted in the system that I am investigating. Table entries 0 is all 3 tables you cite.

SM20/STAD is disabled and I cant possibly ask for authorization

Thanks nevertheless for summarizing options.

Regards

Loknath