Security Audit Log is not active (0170)

[Former Member]

Hi guys,

I am configure "Security Optimization Service Analysis" in solution manager.

In the report section 6.1.8 Security Audit Log is not active (0170) I get the next messages:

Evaluated Risk - High

Recommendation to customize the Security Audit Log.

Settings:

·,,Activate the profile parameter rsau/enable.

·,,Set the profile parameter rsau/selection_slots to its maximum value of 10.

·,,Activate the profile parameter rsau/user_selection

Filter:

·,,Use one filter to log critical events for all users in all clients.

·,,Use other filters to log everything for critical users such as SAP* and support users, including FireFighter users.

·,,Use the remaining filters to log events in special cases.

All settings of profile parameter and filter already exist.

For configuration used this link http://scn.sap.com/thread/3298688

Any body knows what else you need to configure  that a report would not show the risks of paragraph 6.1.8?

[Former Member]

Hi Mikhail

that topic looks perfect! If you've applied all settings , you just need to make SOS repeat the service collection data and the message should disappear

Regards

a

[Former Member]

Hi Andrea,

I did collection data with trx st14

With these parameters:

- BS List personal data (N/Y) | Y

- BS List profiles (N/Y) | Y

- BS User for SAPNet R/3 Frontend | <SAP_UserID> - my s-user.

and send to my solman.

Also I did all steps in solman, but result the same.

[Former Member]

weird

can you paste here screenshots of your static/dynamic config in sm19 and results of rsparam spool?

[Former Member]

Hi Andrea

rsparam:

rsau/enable	1
rsau/selection_slots	10
rsau/user_selection	1

[Former Member]

Hi Mikhail

Filter 3 is not properly configured

Preparing the Security Audit Log - System Security - SAP Library

Cheers

[Former Member]

Hi Pavan,

In URL that you propose I can't find filters that i can configure .

Please explain why filter is not properly configured?

BR

[Former Member]

Hi Mikhail

Click on edit button and click reset button...

then you can see the below

Cheers

Pavan m

[Former Member]

Hi Pavan,

I recreate all filter as described this http://scn.sap.com/thread/3298688

And start security audit. Result the same: Security Audit Log is not active (0170).

May you have idea why system return this message.

[Former Member]

Hi Mikhail

Did u activate the profile (CTRL+F3) ??

Cheers

[Former Member]

Hi Pavan,

All profile activated.

BR