Show TOC

Example FiltersLocate this document in the navigation structure

Typical scenarios for using the Security Audit Log include the following:

  • Recording specific security-critical events, for example, to monitor logon attempts using the standard user SAP*

  • Recording the activities that a specific user executes, for example, to monitor the activities performed by a remote support user

Filter for Recording All Security-Critical Events

To set up a filter for recording all security-critical events, use the Security Audit Log (transaction SM19) to define a static filter with the following criteria defined:

Field or Group Entry
Client *
User *
Audit classes Activate all classes
Events Select Only critical

All critical events will be recorded for all users in all clients.

See the following figure.

Note

You can define the filter more specifically by choosing individual audit classes or entering more detailed data (for example, by entering SAP* as the User name). Choose Detailed display to even more specifically define the various events to audit.

Filter for Recording Activities Performed by a Specific User

Use the Security Audit Log (transaction SM19) to set up a filter for recording security-critical events. Define a dynamic filter with the following criteria defined:

Field or Group Entry
Client <client>
User <user_ID>
Audit classes Activate all classes
Events All

By defining the filter as dynamic, you can activate the filter for the time frame that the user works in the system and deactivate it when the user is finished (for example, for a remote support user).

The following figure shows a filter that is activated to monitor the activities performed by the user SUPPORT in client 450.