Replication or remote RAL logs

[Former Member]

Hello experts,

We are switching from Seclog to RAL (after an upgrade).

In this context our customer has asked us if it is possible to replicate the RAL logs to a remote site, so a internal hacker isn't able to clear his tracks by deleting RAL logs from fx. OS level.

They want us to replicate to a customer secure site.

Is this supported directly in RAL or do we have to make a manual DB replication of relevant tables?

Cheers,

Kenneth

[Former Member]

Hi Kenneth,

actually you have more than one option, you can use the archiving function to move the data out of the system after some time (I'd guess however, this is not what you meant).

In addition you can also use the replication function to retrieve the read-access log from an another system and import it into a central monitoring system. Depending on you ruse case, this might be not enough, as you usually would then use a batch process to just replicate on a regular basis.

In addition to the replication, there is also a monitoring API, which you can use. You can find the documentation of the API in the system. This would allow you to directly send the info to arbitrary destiations, however you will have to code this yourself.

Kind regards,

Patrick

[Former Member]

Thanks Patrick, i will look into those functions.

[Former Member]

Hello again, i am just reading about the archiving part.

Her it says:

************************

.....

Deleting Data from the Archive

Data that has been saved to an archive can be deleted from the database.

Start Archiving Administration ..............

************************

I am a little bit confused, the heading says that you can delete archived data, but in line two it sounds more like you can delete data from the real database, when it has been archived..?

I am not sure i would like an archiving system of security logs, where data can be deleted after being archived.

Am i misreading it?

/Kenneth

[Former Member]

HI Kenneth,

Data archiving is explained in more detail in the docs, in short, you can do both, first write the data to an archive and delete then or just delete without writing.

Regards,

Patrick

[Ulli_Hoffmann]

Hello Patrick,

could you give me a hint where the monitoring API+documentation is included (package or class etc.)?

Thanks,

Ulli

[Former Member]

Hi Ulli,

please search for the interface IF_SRAL_MONITOR

The factory class is named CL_SRAL_READER_FACTORY

Kind regards,

Patrick

[Ulli_Hoffmann]

got it! Thx, Ulli

[Erol_CAGLAR]

You can run SRAL_REPLICATION program under the se38 or sa38 transaction.