SAP GRC 10.0 FF log report - detail level

[former_member296438]

Hi, we are using GRC 10.0 with SP21 and central EAM. When a FF executes e.g. transaction code PA30 in a HR system and changes several values these changes can be seen on the HR system because logging is active. In GRC FF log report I can only see the information that transaction PA30 has been executed but no other details like changed field, old value and new value...From SAP side there is only the information that in SAP GRC 10.0 only tables CDHDR/CDPOS are being checked for change logs. I have searched several blogs/notes but I found no significant information about: 1.) If there is only CDHDR/CDPOS logging data available and therefore it "works as designed" showing only tcode execution for PA30 and not more information 2.) If there will be more information avaiable when using SAP GRC 10.1 3.) An official statement from SAP regarding the logging / checking of transactions which do not store changed data in CDHDR/CDPOS, e.g. HR transaction PA30 Thank you for your answers and regards Thomas

[former_member197694 · Accepted solution]

Hello Thomas,

check the below points

1. Check in SPRO->IMG->Maintain Configuration settings if Parameter ID 4003 "Retrieve Change Log"  option is set to YES.

    Firefighter picks up information from table CDHDR, CDPOS and DBTABLOG.

2. Also it could be that the values do not appear because there are two technical requirements that need to be fulfilled to make sure that changes of a table can be logged.

   a) The general logging has to be activated (rec/client), and the technical setting of the table needs to be adjusted to “Log data changes” (se11).

   b) Only those changes that are captured in table DBTABLOG are collected by program GRAC_SPM_LOG_SYNC_UPDATE and then later displayed in the consolidated log report.

hope this helps you

Regards

Baithi

[former_member296438 · Accepted solution]

Hello Baithi,

thank you for your answer!

I think we are facing the display issues because we are using GRC 10.0

Getting the information by an OSS message that DBTALOG is not caputred in 10.0...so I think this is a good reason for update to 10.1

DBTALOG is capturing the more technical aspects of changes which are relevant for us. CDHDR / CDPOS mainly log business data changes. So I think this is the reason why we get only the information that SE16 or SM30 was executed but no more information about which table ore in special which fields have been changed.

Please correct me if this data is also available in 10.0. I assume you are using 10.1, right?

Regards,

Thomas
.

[former_member239021]

Hi Thomas,

FF log report will provide you details of activities performed,For example -  Consolidated Log report you will get all details also in Log Report column there is Session detail per record.

Click on session details it will display information. make sure that you have scheduled below job hourly/Daily so that it will fetch all records for FF logs.

GRAC_SPM_LOG_SYNC_UPDATE

goto SA38-> GRAC_SPM_LOG_SYNC_UPDATE(program name) -> Insert the Connector name

Regards,

Rakesh Kirve

[former_member296438]

Hi Rakesh,

thank you for your answer. We have scheduled the job on a regularly basis and we can see records in FF log e.g. for FI or MM transactions. The main problem here is that when we change user master data in HR with transaction PA30 you only see in FF log that Tcode PA30 has been executed. You do not get any information about which fields have been changed in a specific user. So honestly speaking getting the information that PA30 was executed is nice to see...but you want to know what have been changed. It is the same when you change a table entry with SM30. You want to know the old field value and the new field value.

Regards,

Thomas