Show TOC

Defining FiltersLocate this document in the navigation structure

Prerequisites

  • You have defined the parameters relating to filters, such as, the number of filters you can use or how users are defined.

    For more information, see Preparing the Security Audit Log.

  • You are either defining static profiles or changing filters dynamically using the security audit log configuration tool. For each allocated filter, a tab appears in the lower section of the screen.

    For more information, see:

Context

You define the events that the security audit log should record in filters.

You can specify the following information in the filters:

  • User

  • SAP system client

  • Audit class (for example, dialog logon attempts or changes to user master records)

  • Weight of event (for example, critical or important)

For examples of filters, see Example Filters.

You can define filters that you save in static profiles in the database or you can define them dynamically for all running application servers.

Procedure


  1. Select the tab for the filter you want to define.

  2. Enter the Client and User names in the corresponding fields.

  3. Select the corresponding Audit classes for the events you want to audit.

  4. Audit events are divided into three categories, critical, important, and non-critical. Select the corresponding categories to audit.

    • Only critical

    • Important and critical

    • All

  5. If you want to define the events to audit more specifically:

    1. Choose Detailed configuration.

      A table appears containing a detailed list of the audit classes with their corresponding event classes (critical, severe, non-critical) and message texts. (The message texts correspond to the system log messages.)

    2. Select the events you want to audit.

    3. Choose Accept changes.

      The filter tabs reappear.

      Note

      If you have made detailed settings, then the audit class and event class indicators no longer appear in the corresponding filter tab. To cancel the detailed settings and reload the default configuration, choose Reset.

  6. To activate the filter, select the Filter active indicator.

  7. Continue with defining static profiles or changing filters dynamically.