Monitoring the Read Access Log

Context

You use the read access log for evaluation purposes. In it, all log entries as well as all errors that occurred in Read Access Logging are displayed. There are four data sources from which you can display log entries:

Raw Database

Only contains the Read Access Logging data of the current client.
Expanded Database (default)

Can contain the Read Access Logging data of the current client as well as other clients.

Note The Expanded Database is initially empty. Only after you import data using SRAL_REPLICATION will it contain logging data to view. See Retrieving Logs from Other Systems
Raw Archive

Archive of the Raw database.
Raw Archive with Index

Indexed archive of the Raw database.

The table below shows the available Search Criteria fields and/or fields displayed in the read access log.

You can switch between the Default and the Extended view in the read access log.

Property	Meaning and Possible Values
Created at (Local Time)	The creation date of the log entry according to local time
System ID (Available only when the Expanded Database is selected as the data source.)	The System ID of the SAP system which the logging data is from
Client (Available only when the Expanded Database is selected as the data source.)	The client number of the SAP system which the logging data is from
Data (Available only when the Expanded Database is selected as the data source.)	The field value
Log Domain	The classification of the log into a business area
User Name	The user who accessed the data
Channel	The channel that was logged. Possible channels are currently: Remote Function Call Web Dynpro Web Service
Direction	Communication Client indicates that the call was logged on the consumer/client side. Communication Server indicates that the call was logged on the provider/server side. For Web Dynpro, only Output can be logged.
Logging Purpose	The logging purpose is assigned to each log entry.
Read Status	Application Error means that the read access that was logged could not be processed successfully because of an application error. Success means that the read access was successful. That is, the information was displayed to the user. Technical error means that the read access that was logged could not be processed successfully because of a technical error, for example a communication error.
Read Access Error	The error message provides information about the error that occurred.
Application Component	The application component to which the logged object is assigned.
Software Component	The software component to which the logged object is assigned.
Client IP Address (in extended view only)	The IP address of the consumer/client system that calls a Web service/remote function module in a provider/server system. This information is only contained in the log on the provider/server side. For Web Dynpro, the IP address of the user who accessed the data.
Log ID (in extended view only)	Each log entry has a unique ID.
Configuration ID (in extended view only)	The ID of the configuration that caused this log entry to be created.
Correlation ID (in extended view only)	Web services: The correlation ID is the message ID. It enables you to correlate the corresponding log entries on the consumer and provider side and to have a connection to messages in the Web services monitor or Web services error log. Web Dynpro: The correlation ID is the session ID. RFC: For RFC, the correlation ID bundles log entries that belong together. For example, for aRFC, one log entry is created for the request that leaves the system, and one log entry is created for the response. With the correlation ID, the two entries can be connected. For bgRFC, all function modules within a unit have the same correlation ID.
Legal Entity Type (in extended view only)	The legal entity type is always the client.
Legal Entity Value (in extended view only)	The client number.
App. Server (in extended view only)	The application server.

Note

For Web Service channels:

Communication Client direction – A single web service call can sometimes result in two entries with two different Read Statuses. A Success entry is always written before the request message is sent to the communication server. The response of the communication server determines whether a further log entry is recorded:

For successful or aborted messages from the communication (consumer) server, no further log entry is recorded.
For aborted messages from the provider server, a HTTP error log entry is recorded.
For all error messages, an additional log entry is recorded as either Application Error or Technical Error. Note that the initial Success entry is not deleted.

Communication Server direction – Only a single log entry is recorded. The response from the communication server is the single and final message.

For Web Service and RFC channels:

For asynchronous web service calls and for queued asynchronous RFC (tRFC, qRFC, bgRFC) calls, the transfer of the call to the communication server may be delayed in high load situations. This can result in a gap between the user's action and the timestamp of the Read Access Log entry.

For errors detected on the communication client (for example, a communication error, communication timeout, or an error response) one or more retries can follow. These retries result in additional Read Access Log entries using timestamps of when they were executed.

Procedure

Go to transaction code SRALMONITOR to open the Read Access Logging Monitor.
Alternatively, go to Read Access Logging manager (transaction code SRALMANAGER) and choose Read Access Log on the Monitor tab.
Select the data source from which you want to display log entries.
Search for the log entries you want to evaluate.

To search for values of fields that have been accessed, you must use the Expanded Database as the source.

For data source Archive, select the archive in which you want to search for log entries. Additionally, there are various search criteria that you can use (choose the icon). Typically, you would search for a time range and a log domain or a logging purpose. These search criteria are also available if you search using the database as the source.

Note that searching the archive may be time-consuming. It is much faster if you search an archive with an index. In this case, the search criteria that you have specified for the index are available.

When you choose Search, all log entries are displayed that match your search criteria. By default, only a few attributes are displayed per log entry. You can switch between the default and the extended view.

Within the search, you can clear the values you have entered for search criteria by choosing Clear, and you can reset the search criteria to the default by choosing Reset.
Select a log entry to display detailed information at the bottom.

On the Details tab, all fields are displayed with their log domain and, if logged, the field values. On the Access Environment tab, you find more information about the underlying object that was logged. For example, for Web services, the internal and external names of the underlying Web service are displayed.

Note If the Field Value in the RAL Monitor is empty, the field contained no value. If the Field Value displays initial, the field did contain a value, but it was not logged (see the Logging Type setting in Defining Configurations in Read Access Logging).