Carriage Return on SAP Security Audit Log

[Former Member]

Hi,

Would like to ask if anyone can help me write a Unix script that will break the Security Audit log into one security entry per line or insert a carriage return per entry which will be written to a new log file? We need to setup log file monitoring via RZ20 in Security Audit log file to monitor and capture specific pattern but we are having problem capturing accurate and correct entries in the log due to the nature of Security Audit log file that has no carriage return or line separator.

Thanks.

Rupert

[Former Member]

Hello Rupert

these few lines of perl code should help you to split a Security Audit Log

open(FILE, "<FILE-NAME>") || die("Error reading file, stopped");
while(read(FILE, $buffer, 200) ) {
	print "$buffer\n";
}
close(FILE);

BTW you can also expand the print statement with an if clause and regexp to filter by Message-ID. The example shows a filter for logged RFC calls (MNo=AUK).

print "$buffer\n" if ($buffer=~/2AUK/);

regards/marc

[floK]

Hi Marc

Thx. for the Code. I would integrate before the print buffer follow line:

     $buffer =~ s/[\x20\x00]//g;

To get rid of NUL and space chars ;-)....

regards Flo