User Logoff event not recorded in SM20 for Logon type=A

[Former Member]

Hi Security Guys,

We are recording the audit logs for Dialog logon. The problem is the User Logoff event between two consecutive logons is not getting recorded sometimes for almost all users.

Kindly check below table filtered for one particular user.

20-03-2016	09:50:20 AM	300	USBO1	Logon successful (type=A, method=P )
20-03-2016	10:50:46 AM	300	USBO1	User Logoff
20-03-2016	11:04:53 AM	300	USBO1	Logon successful (type=A, method=P )
20-03-2016	01:09:59 PM	300	USBO1	Logon successful (type=A, method=P )
20-03-2016	04:46:27 PM	300	USBO1	Logon successful (type=A, method=P )

SM19 setting:-

Regards,

Saurabh  Thorat

[Vanes]

Do you have more then one application server? It is often the case that there are more application servers but the Audit Log is configured to write to one file only which causes that the events are getting overwritten when users log off/log on at the same time from/to different application servers.

[Former Member]

Did you set the parameter

Dialog Logon  Non-Crit. TRUE   User Logoff

[michael_kozlowski]

Check whether SAP note 1252909 - No logoff (AUC) for service users in the Security Audit Log is applicable for you system.

[Former Member]

Hi Michael Thanks for the reply, The Note is not applicable for our system since basis and kernel release are 740. Plus this problem occurring for dialog users and we are not so concerned about the system users.