Syslog Trace and System Alert Monitor 
Syslog Trace and System Alert Monitor
Use
If a user tries to execute a command that was created or changed illegally, an entry is automatically made in the system log.
The syslog area '
LC ' is reserved for external commands.You can decide whether these events are displayed in the alert monitor.
To maintain the alert thresholds:
From the main R/3 menu, choose Tools
® CCMS, Configuration ® Alert monitor ® Threshold values (3.x).Alternatively, call Transaction RZ06.
See also:
Check Modules Illegal Changes to External Commands