GRC AC 10.1 - Firefighter Session Details Audit Log Report

[Former Member]

Hello

Our audit log report is not populating with data and I'm trying to determine if that's ok or if there's a configuration issue. I checked our parameters and we enabled Audit Log data retrieval. I know that log captures data from transaction SM20. Does that mean the transaction has to be executed? What situations should that log be populated? Any other tips on other configuration that can be checked?

Any assistance is appreciated. Below is a screenshot of the empty audit log. The path is NWBC -> Reports and Analytics -> Emergency Access Management User Reports -> Transaction Log and Session Details

[chandani_kaur]

Hello,

Please check if following  Notes are implemented in your system:

2019638 - AC 10.0 SPM audit logs showing wrong results for locked FFIDs

1976361 - GRC EAM: Performance Issue in retrieving Security Audit Log (SM20)

1864056 - EAM10:Audit logs are not displayed in consolidated log report

Also check ST22 in plugin system for any dump.

Thanks & Regards,
Chandani Kaur

[alessandr0]

Hello,

please check the following document in regard of EAM logging:

The log should be populated whenever the sync jobs ran. Make sure that the user who retrieves the data from the backend has sufficient authorization in the backend system. Therefore check STAUTHTRACE or ST01.

Let us know.

Regards,

Alessandro