Security Audit Log FULL. What happens??

[Former Member]

Hi there,

Can anyone tell me what will happen when the Security audit Log file is full on OS-level. Will the system stop? Is the file overwritten?

Best regards,

Joris

[Former Member]

Hello Joris ,

1 ) Is the file overwritten? -> No

2 ) Will the system stop? -> Yes , if there will no free space on drive / file system SAP system will stop.

How to delete :

1. To access the Security Audit Log reorganization tool from the SAP standard menu, choose Administration à System Administration à Monitor à Security Audit Log à Reorganization.

The Security Audit: Delete Old Audit Logs screen appears.

2. Enter the Minimum age of files to delete (default = 30 days).

This value must be > 3.

3. Activate the To all active instances indicator to delete the audit files from all application servers. Leave the indicator blank if you only want to delete the files from the local application server.

4. Activate the Simulation only indicator if you do not actually want to delete the files. In this case, the action is only simulated.

5. Choose Audit Log à Continue

Regards ,

Santosh Karadkar

[desiree_matas]

Hello Joris

Check SAP note 539404: FAQ: Answers to questions about the Security Audit

"[22] Question: What happens if the audit file reaches its maximum size?

Answer: The file is closed and recording is terminated. On the next day,

the system creates a new file (only as of 4.5B KP 632 4.6D KP 2088, 6.40

KP 80, 7.00 KP 51)."

Regards,

Désiré

[Former Member]

Just to clarify - the SAL will create a new log file daily. If you had set the parameter - rsau/max_diskspace/local - to 1 meg and this file filled during the day, then logging would stop. The next day a new file would be created and the log would fill again until you reached the day's max file space.