Getting Logon User Counts from Authentication logs

This Blog Describe how to extract the total number of End users & Service users logon counts from each Portal server node using Authentication logs .This information correctly depicts the total number of logon, user has performed unlike the unique login of the user provided in portal activity reports. Analyst /Consultants can merge this information logs with the Backend ECC/HR/SRM/CRM user logs maintained in USR02 tables for further reporting purposes for determining business transactions in more detailed manner.

following are the steps :

1) Go to NWA log viewer of SAP Portal

2) Choose authentication log from view

3) Click everywhere and from advance filter choose date filter and set it for biggining of day time till present time click on apply filter

4) Now download the excel file of logs from log file download content

5) Choose all column and download

6) Save it on the location you like on your machine. Now open excel file and apply filter, Select all login ok and application irj logs and now choose and count the required users

Below example show total number of 120 logons from the selected date on all the nodes of SAP portal for all user types, user type can be selected from user dropdown (Service or end user)

Portal Consultants can merge this information with ECC/ABAP system user logs and device statistics and reports ,they can formulate a Excel template based on their requirement  if they want and feed the data from ABAP system and Portal Authentication logs and generate Graphs out of it.

Main Advantage which I see in this approach is no coding required (Java or ABAP) and all the user logins(End users & Service users) based on the application(irj) can be identified from all server nodes, the approach works well in the Portal scenario where login screen is used by the users for Login to Portal.

I am listing down some use cases where this approach can be used:

— Getting the last logon date of WAS users or irj Portal users.

— Generating Portal Usage history reports from this logs using some reporting tool like Excel etc.

— Can be used for Auditing purpose and to identify security attacks

Its good to take a back up of these logs periodically as depending on portal usage and log size configured ,logs will be overwritten once the log size reaches its maximum value.

Some references:

https://help.sap.com/saphelp_nw73ehp1/helpdata/en/4a/f2b882455732c6e10000000a421937/content.htm

https://help.sap.com/saphelp_nw73ehp1/helpdata/en/47/af4560fa711503e10000000a42189c/content.htm

Thanks for reading!

Siddharth Jain