filesystem /usr/sap/SID full

[Former Member]

Hi,

Recently, we had an issue that filesystem /usr/sap/SID is full. Upon investigation, we noticed that audit log files (.AUD) under /usr/sap/SID/DVEBMGSnn/log consumes too much space. My question now:

1. Is there a standard job that do the housekeeping of these audit files?

2. Can we delete these audit files manually?

Thank you in advance!!!

[Former Member · Accepted solution]

You can delete them in SM18, and can schedule this as a periodic job if appropriate. You can also just delete the files directly in the file system - nothing will mind. The SM20 report only looks at files that exist and doesn't notice any that might have been deleted.

Before you do anything with the audit logs, though, you should check with the business, and especially your auditors, how long they should be retained for. The answer might be longer than you think.

Personally I don't delete them at all, but I do compress them after a while. They are plain text files and so compress very well. If anybody needs to look that far back I can just uncompress them again.

Steve.

[cris_hansen]

Hi Philip,

Just to add a few to Steve's answer, you can also limit the file size for each audit file (SAP note 539404, Q/A 28).

You can move the files to another filesystem (compress them beforehand).

You can always read old SAL files using report RSAU_SELECT_EVENTS.

My 2 cents,

Cris

[Former Member]

Although of course if you limit the file size, your audio log is then incomplete...

Steve.