AUDIT CONFIGURATION CHANGED : SLOT INACTIVE

[Former Member]

Hello ,

We've configured security autid via parameters below :

rsau/max_diskspace/per_day:     1996800K

rsau/max_diskspace/local          2048000K    

rsau/max_diskspace/per_file      665600K

rsau/enable                               1              

rsau/selection_slots                     30    

rsau/local/file D:\usr\sap\FKP\DVEBMGS00\log\++++++++.AUD

FN_AUDIT ++++++++######.AUD

DIR_AUDIT D:\usr\sap\FKP\DVEBMGS00\log           

In our production system and we repaired security audit screens with abap consultants . Then  we could activate audit log for 30 slots . It works very well . We restarted system several times and we didn't get any problem about security configuration .

After a few months  , we restarted the system and the slots which we add later changed to inactive .You can see  SM20 logs below :

Application Server Stopped

Application Server Started

Audit Configuration Changed

Audit: Slot 1: Class 191, Severity 2, User USER1, Client 200,

Audit: Slot 2: Class 191, Severity 2, User USER2 , Client 200,

Audit: Slot 3: Class 191, Severity 2, User USER3, Client 200,

Audit: Slot 4: Class 191, Severity 2, User USER4, Client 200,

Audit: Slot 5: Class 191, Severity 2, User USER5, Client 200,

Audit: Slot 6: Class 191, Severity 2, User USER6, Client 200,

Audit: Slot 7: Class 191, Severity 2, User USER7, Client *,

Audit: Slot 8: Class 191, Severity 2, User USER8, Client *,

Audit: Slot 9: Class 191, Severity 2, User USER9, Client *,

Audit: Slot 10: Class 191, Severity 2, User USER10, Client *,

Audit: Slot 11 Inactive

Audit: Slot 12 Inactive

Audit: Slot 13 Inactive

Audit: Slot 14 Inactive

Audit: Slot 15 Inactive

Audit: Slot 16 Inactive

Audit: Slot 17 Inactive

Audit: Slot 18 Inactive

Audit: Slot 19 Inactive

Audit: Slot 20 Inactive

Audit: Slot 21 Inactive

Audit: Slot 22 Inactive

Audit: Slot 23 Inactive

Audit: Slot 24 Inactive

Audit: Slot 25 Inactive

Audit: Slot 26 Inactive

Audit: Slot 27 Inactive

Audit: Slot 28 Inactive

Audit: Slot 29 Inactive

Audit: Slot 30 Inactive

We didn't change any parameters or audit configuration before restart   but as I said , after restart audit configuration has changed.

Does anyone has an idea about why audit configuration has changed  ?

Thanks & Regards

Ozlem Otunctemur

[Former Member]

Özlem Ötünçtemur wrote:

rsau/selection_slots                     30     
...       


... we repaired security audit screens with abap consultants . 

Have you considered that these ABAP consultants might have made a mess?

The selection slots does not support more than 12 tabs and thankfully your ABAP consultants can't "repair" the SAP kernel which writes the log.

You should read SAP Note # 7 in this case and ask SAP for assistance.

Cheers,

Julius

[Former Member]

Hello ,

We solved this problem by checking audit log configuration in SM19.

Thank you for your answer.

Kind Regards