How to trace logon terminal

[Syamkriz]

Hi,

I have a strange client copy happened in my R/3 system(4.7Enterprise).This was done by somebody from production system to quality system.As a result of this we lost some data in quality.We were able to see the 1)from which userid2)time

and duration etc..details from SCC3.But we require the terminal from which client copy was done.Is there anyway to see this information,any table which keeps the terminal id logs? Please help.

Thanks in advance

Syamkrishnan

[Former Member]

Do you have Security Audit Logging activated? That will display terminal for the logon event if you have that option switched on in the filter.

Alternatively you may be able to get useful information from STAT or ST03N, however I think that may be limited to IP address only which may or may not be useful to you depending on your setup.

[manohar_kappala2]

Hi Syam,

You can get this information from the ST03N transaction.

Go to ST03N> Expand Detailed Analysis> Select Business transaction analysis --> Give the user name in the User field and run the report for the day on which you want this report and double click on the report entries and in the details you can find the teminal ID in the "Task and memory information".

Hope this helps

cheers,

Manohar

[Syamkriz]

Hi,

Thank you very much Alex and Manohar.I have awarded points for your suggestions.We have not activated security audit logging.I have accessed transaction both STAT directly and through ST03N(Go to ST03N> Expand Detailed Analysis> Select Business transaction analysis --> Give the user name in the User field,as said by manohar )

but couldn't get any logs.We could obtain the logs upto last two days from STAT,but since the incident was happened even before the last two days we couldn't see any logs related to that.

But I would like to share an important information which I found .

You could find the information related in table USR41 (TERMINAL...)which will record the last logon information.But if you are asking for the historical data :

Sorry for system will not keep all the history unless you confirm that you could use SM19 to activate the security audit log and read it via SM20 and note 539404 is for your reference(security audit suggested by alex :-)thanks alex).

Thanks&Regards

Syamkrishnan