Client Opening Logs

[Former Member]

Hi,

The auditor wants to know the details about client opening activities carried out. Our basis team has given him the following log. from this log how do we make out when was the client opened and when it was closed.

If this is not the log to look for opening/closing of client , where do i get the details about client opening and closing.

the auditor says that the value corr. sys indicates when the client was opened and closed. according to him, corr. sys = 2, indicates the client is closed and corr. sys. = blank, indicates client is open. so in this according to the auditor the client was opend on 11.04.2007 and closed on 13.04.2007 . is this correct?

plz help.

thanks

yash

Customizing Objects: Change Logs 1

Clients

Technical Name: T000

Date : 11.04.2007 User: BCAVI

Key Fields Function fields, changed

Time Client Field Name Old New

12:17:50 200 Role P T

Corr. sys. 2

NoCrsCli 3

Copy lock X

CHANGEDATE 23.03.2007 11.04.2007

Date : 14.04.2007 User: BCRAJ

Key Fields Function fields, changed

Time Client Field Name Old New

10:48:40 200 Role T P

Corr. sys. 2

NoCrsCli 3

CHANGEUSER BCAVI BCRAJ

CHANGEDATE 11.04.2007 14.04.2007

[Former Member]

Hi,

From memory your auditor is correct. The values correspond with the entries you make in SCC4 (You should be able to match the logs back to the current settings).

you get the log info from SCC4 under the utilities menu

[Former Member]

thanks for the prompt reply.

where would i get more information about all the possible values for corr. sys.

thanks.

[Former Member]

> where would i get more information about all the possible values for corr. sys.

If you look in SCC4 you can see the corresponding values

e.g. for cross client object changes you have

1 no changes to cross client cust objects

2 no changes to repository objects

You can reconcile these against the report. The values you see there are all the possible values

[Former Member]

thanks.

what i would like to know is where would i get the description for the values that are seen in the report. i.e 2 = client is closed, blank = client is open etc.

also if what the auditor says is right, every client opening session should ideally (assuming its closed the same day its opened) have 2 entries for corr. sys one from 2 to blank and the other one from blank to 2.

however while scanning through the log we find that the value of corr sys was changed from 2 to blank on a particular day and the next entry in the log is of a date nearly a month or so after this date with corr sys value from blank to 2, this would imply the client was open for over a month, which seems nearly impossible in a production environment.

hence i would like to know for sure if this is the only and the correct way of determining how long was the client open.

is there any other way to determine this.

thanks.

[Former Member]

>

> what i would like to know is where would i get the description for the values that are seen in the report. i.e 2 = client is closed, blank = client is open etc.

This info is in SCC4 - open it up and you will see the descriptions of what each status stands for - I gave you a couple of examples earlier which I took from SCC4 screen and contarin the number and text for that particular field.

Do the same for the rest and you will have a complete list.

> also if what the auditor says is right, every client opening session should ideally (assuming its closed the same day its opened) have 2 entries for corr. sys one from 2 to blank and the other one from blank to 2.

> however while scanning through the log we find that the value of corr sys was changed from 2 to blank on a particular day and the next entry in the log is of a date nearly a month or so after this date with corr sys value from blank to 2, this would imply the client was open for over a month, which seems nearly impossible in a production environment.

That is very common. To get round this, many companies have a periodic check (e.g. weekly) that the client is locked. Often clients are opened and then people forget to close them again.

I don't know any other ways of checking this, what your auditor is suggesting is the main way that I am aware of.

[Former Member]

thanks a lot alex for the patience with which you have answered my queries.

i'll wait to see if some more views come up before i close my question.

thanks again for all the help.

[Former Member]

Hi,

a belated reply, but if if you want to monitor this, I have setup a background job that monitors changes to this table. Not rocket science , but works. check it out at the following [link|https://sites.google.com/site/puduville/Home/sap-security-tips#TOC-Setup-Monitoring-Job-to-control-cli].

You can use your imagination and use this same method to monitor many other security controls.

Hope it helps

Denis

[Former Member]

Thanks for sharing - despite being an ancient post which didn't really need to be bumped again...

I use the same approach for local monitoring, but it can be a pest for central monitoring from SolMan because you only have spool files to work with and some reports create a spool request just to write some selection criteria into... so you send mails without content (the SE16 selection screen programs are okay though).

An option is to monitor the jobs from Solman though, or launch them from there.

Cheers,

Julius