SM20 return empty result

[Former Member]

Dear Expert,

I am turning on my SAP security audit log. however I couldn't read the audit log from SM20. Following are the screen shot for the setting

1) RZ10

2) SM19

3) SM20 : Result Empty

however, I can see the audit data in local server directory as below:

I had try to restart but still having same problem. Appreciate your advise.

Thanks and Regards,
Sri

[Former Member · Accepted solution]

Dear All,

Thanks for the guide. I solved the problem by removing the rsau/max_diskspace/per_day &

rsau/max_diskspace/per_file and only use rsau/max_diskspace/local.

restart the application server then can read the audit report from sm20.

I know the actual problem from sm21 which tell me the actual problem and guide how to solve it.

[Former Member]

Dear

Have you activated the audit log thru sm19 and set rsau/enable parameter to 1?

you have to rsau/enable = 1 on all of your application servers

Also, you can activate table auditing using parameter rec/client and then enable logging for specific tables requiring it(should only be done on small tables). Table T000(SCC4) has logging enabled by default when table auditing is activated.

Regards

[Former Member]

rsau/enable already set to 1

rec/client also already set to all.

any other setup I miss out?

[Former Member]

Dear

you are running these on dev server you will  not getting any value Then it to PRD which is live SYSTEM and make all above changes according the above document....

Regards

[Former Member]

Do you meant because of dev env. no transaction incurred? I actually create critical even such as login attempt failed in DEV server. I can see the event is logged in the audit file (in the application server). just that it cannot be read from SM20.

kindly help.

[Former Member]

Hello,

do you have set the parameter rec/client in profile DEFAULT.PFL? Which value do you have there for this parameter?

Kind regards

[Former Member]

Dear Kamil,

I don't have rec/client parameter setup in the default profile. should I add the parameter?

if yes, could you recommend the setting?

FYI, I am doing the testing in DEV server.

[Former Member]

Yes, I think it should be set up. I would recommend to set it to value ALL (reffered to Setting Rec/Client Parameter for Logging - Customizing System Setting (BC-CUS) - SAP Library ). Do not forget to restart the system after changing the parameter.

[Former Member]

Dear Kamil,

I just add the rec/client and restart the server. but still the result is empty. I set the rec/client param

in the instance profile.

[Former Member]

Please, can you try to set also parameter rsau/user_selection = 1?

I read some other threads and in all of them they advice to set it to 1.

[Former Member]

Dear Kamil,

I had tried to set that also. and restart the application server. same result. still could get the audit report from sm20 . I put the rec/client in the instance profile, is there any issue?

[Former Member]

Well, unfortunately I don't have any other idea. It should not matter in which profile you have set the parameter.

By the way, which version of NetWeaver you have? Here is official manual for 7.0 EHP2 - Maintaining Static Profiles - System Security - SAP Library

And one more question, when you start SM18, do you see all the logs which are saved on the harddrive?

[Former Member]

I am in ECC6 EHP 0. I tried in sm18 (simulation mode) age = 30.

No files deleted.

Is it because of I'm in EHP 0?