Approve multiple Fire Fighter logs in once

[former_member225180]

Dear all,

we had to start the program GRAC_EAM_LOG_SYNC_TIMEBASED to start the FF-Log creation and the e-mail notification for the FF-Controller.

The result is that there are more then 400 FF-logs are to check/approve now.

Does someone know a program to approve these log in an masse change?

BR

Melanie

[former_member225180 · Accepted solution]

Dear all,

the answer of Alessandro was the same as I have given inside of the Company.

But it is good to have the feedback and confirmation of specialists, now.

Thank you!

BR

Melanie

[Former Member]

Hi Melanie,

I am on GRC 10 SP 11.  We have missing EAM logs. I have an incident with SAP.  They told me to run the GRAC_EAM_LOG_SYNC_TIMEBASED program.  I am not able to get this program to run.  I have asked them for additional instructions.  I was searching today and saw you were able to run the program.  Can you tell me how you were able to do run GRAC_EAM_LOG_SYNC_TIMEBASED?

Thanks in advance,

Denise Mann

[former_member225180]

Hi Denis,

sorry for the late answer. We had Connection Problems between our Company and  SCN.

Here the steps how Í could execute the Report for FF-logs which were not created, but must be there.

IF you will see the FF-log approval file via UI -> Access Management ->Search Request -> Switch selection criteria "Proces ID" to "Firefighter Log Report Review Log Worflow".

Meanwhile wie have created a Job that runs every night with this program

Hope this will help you!

BR Melanie

[Former Member]

It seems the business/customer/chiefs require to understand the whole point of compliance

Remember, the whole idea of "Firefighting" is for Emergencies only, therefore if the company is questioning why there are over 400 session logs generated for review, the real question to be raised is "why are the FFID's being used too frequently?"

It would not be surprising to see that the firefighters may have just simply ran a whole bunch of Display transactions in the majority of the 400 sessions!

"The tool is only as good as the usage and monitoring policy put in place"

[Colleen]

And that is also why the FF ID should only be assigned the necessary access to perform the agreed emergency access. If they are using display on it then remove the access unless it's needed fir a change access.

[Former Member]

Melanie,

Please do not suggest such a change in Idea Place. Attempting to approve FF logs en mass would escape the entire point of the control, which is to review the actions taken by the user given elevated access for appropriateness to the situation. If reviewing the logs is too burdensome for the FF-Controller, it may be that there are tcodes in the FF roles that do not pose serious enough risk to warrant monitoring. I would suggest ensuring that only tcodes that require review be in your FF roles, and that the organization has designated enough Controllers so that the logs can be reviewed promptly.

Regards,

Gretchen

[alessandr0]

Hi Melanie,

there is no program or possibility to approve multiple EAM requests. Also that doesn't make sense and isn't compliant at all. Hence the possibility is not given.

Regards,

Alessandro

[Former Member]

Hi Melanie,

No, there is no way to approve logs in mass, (not to my knowledge at least) no matter if you have one or hundreds of those.

May be you can post this request in SAP-Ideas

Regards,

Ameet