Analysis and Recommended Settings of the Security Audit Log (SM19 / RSAU_CONFIG, SM20 / RSAU_READ_LOG)

Recommended Settings for the Security Audit Log (SM19 / RSAU_CONFIG, SM20 / RSAU_READ_LOG)

See note 2676384

Profile Parameters / Kernel Parameters

rsau/enable = 1

rsau/selection_slots = 10 (or higher if available)

rsau/user_selection = 1

rsau/integrity = 1

DIR_AUDIT and FN_AUDIT define the path and the file name pattern for the log files. These are the only profile parameters which are in use if you have switched to the “Kernel Parameters”.

As of release SAP_BASIS 7.40 you can use the so-called “Kernel Parameters” instead of the listed Profile Parameters. You find them on a new tab in transaction SM19 respective transaction RSAU_CONFIG. See chapter Preparing the Security Audit Log in the Online Documentation. You can set them dynamically and once set they overwrite the values of the profile parameters. Take care to inspect these Kernel Parameters after an upgrade to SAP_BASIS 7.40 or higher.

Filter settings in SM19 / RSAU_CONFIG

Depending on the release you can set 10, 15 (as of SAP_BASIS 7.40 SP 8) or 90 (as of SAP_BASIS 7.50 SP 2) filters. See FAQ Note 539404 item [4].

1. Filter: Activate everything which is critical for all users ‘*’ in all clients  ‘*’.

• You may deactivate the messages of class “User master record change (32)” because you get change documents for users in transaction SUIM anyway.
• Consider to add messages AUO, AUZ, BU5, BU6, BU7, BU9, BUA, BUB BUC, BUH, AUP, AUQ
• If you maintain logical file names using transaction FILE (see note 1497003) than add messages CUQ, CUR, CUS, CUT, DU5
• If you maintain an Access Control List for RFC callback (see note 2128095) than add messages DUI, DUJ, DUK

2. Filter: Activate everything for special user SAP* in all clients ‘*’

You cannot use a filter ‘SAP*’ because this would include the virtual user SAPSYS because of profile parameter rsau/user_selection = 1. This virtual user SAPSYS performs many house-keeping activities triggered by the system itself. You do not want to log these events.

However, you can use the special filter value ‘SAP#*’ instead.

You can use this special filter value ‘SAP#*’ in transaction SM20, report RSAU_SELECT_EVENTS respective transaction/report RSAU_READ_LOG as well to show log entries in for user SAP* only.

If you can defines positive and negative filters for user groups (see note 2285879) then you can create filters for user groups like SUPER instead. This has the additional advantage that the built-in user SAPSYS does not produce any logs.

3+4. Filter: Activate everything for other support and emergency users, e.g. ‘SAPSUPPORT*’ (SAP Support users) respective ‘FF*’ (FireFighter) in all clients ‘*’.

If you can defines filters for user groups then you can create filters for corresponding user groups instead.

5. Filter: Activate all events for the dialog activities ‘logon’ and ‘transaction’ for user ‘DDIC’ in all clients ‘*’. This user should not be used in dialog mode. It’s only required for specific activities while applying support packages or while importing transports (however in this case you can use another background user as well).

6. Filter: Activate everything for client ‘066’. This client is not used anymore and can be deleted (see https://blogs.sap.com/2013/06/06/how-to-remove-unused-clients-including-client-001-and-066/ ).

7. Filter: Activate RFC events (AUL, AUK, AU6, AU5) for a short time for selected users to identity RFC connection problems easily (see https://blogs.sap.com/2010/12/05/how-to-get-rfc-call-traces-to-build-authorizations-for-srfc-for-free/ ).

8. and following Filter: free for other project specific purpose

Hints:

The client field accepts either single values like 000 or a * to catch all clients.

The user field accepts pattern characters as well (see note 574914):

* any sequence of characters (only the first * within the filter string is interpreted as a pattern character)

+ one character

# disable following pattern character

The user group field accepts exacts values only.

Using the print function (command PRINT) in transaction SM19 or using report RSAU_INFO_SYAG you can show an overview about the current settings.

List of events

If you miss some of the events described in this document then search for notes of application component BC-SEC-SAL.

Using note 1970644 you can get report RSAU_INFO_SYAG which shows all events of the Security Audit Log including a summarized status about the activation of the events. The detail view allows you to create an HTML-based event definition print list including the full documentation.

Within transaction SM19 you can use the system function =PRINT (respective the printer icon in the top icon row) to document the definition of static profiles as well as the current definition of the dynamic configuration. This list shows the details about all filter slots.

Events ordered by selected topics and security optimization projects:

Note 2073809 shows special documentation/changes about the messages

• BUY (which is replaced by message CUL),
• CUY (which is related to debugger messages BUZ, CUL, CU_M, CUN, CUO, CUP), and
• CUZ (which is related to message DU9).

List of events from table TSL1D respective report RSAU_INFO_SYAG.

This list is a snapshot – check it in your system – with a comparison between release 702, 740 and 750. Some of the new messages may be added with 731 or with downports already. See following notes which are described in report RSAU_SYNC_EVENTS (start this report in the development system to bring the event definitions up to date):

Note 1411741 BUY CUK
Note 1639726 CUQ CUR CUS CUT
Note 1666804 BUX
Note 1686247 DU1 DU2 DU3 DU4 DU5 DU6 DU7
Note 1707878 CUU CUX
Note 1789518 AU1 AU2 AU5 AU6
Note 1792047 DUA DUB DUC DUD DUF DUG
Note 1802077 BUV BUW DUH
Note 1880984 DUL DUM DUN DUO BU0 CU0 DUP DUQ
Note 1938382 DUR DUS DUT
Note 1941526 DUX DUY DUZ
Note 1941568 DUX DUY DUZ
Note 1968729 DUI DUJ DUK
Note 2073809 CUY BUY CUZ
Note 2128095 DUI DUJ DUK
Note 2161582 FU1 FU2
Note 2176138 AU1 AU2 AU6 BUA BUB BUC BUD BUE BUI CU0 DUI DUJ DUK DUQ DUU DUV
Note 2234569 AUY
Note 2252312 DUJ DUK
Note 2299636 EU1 EU2 EUQ EUR
Note 2312710 DU1 DU2 DU3 DU4 DU5 DU6 DU7
Note 2446979 EU3 EU4 EU5
Note 2478128 EUA EUB EUC EUD EUE EUF EUG EUH EUV
Note 2578343 EUV
Note 2522156 EUI EUJ EUK EUL EUM EUN EUO EUL EUM EUN
Note 2578918 DUW
Note 2785904 FU3 FU4 FU8 FUA FUB FUC FUD FUE
sync 04/2020: FU0 EUP EUY EUZ BUX

File format

Warning: The file format is defined SAP internally – it’s not an official definition which can be used freely. Use the information with care as storage and format can change with newer releases.

As of release 7.50 you can choose if log events are stored in the files as described in this section or in the database table RSAU_BUF_DATA or at both locations (see note 2191612).

Use report RSAU_SELECT_EVENTS to analyze the file format.

The audit files have a structured but variable record layout in unicode text format.

The administrative information is fixed, however, there exist 2 record formats depending on the existence of the additional field SLGLTRM2.

The data part, field SLGDATA, containing 64 characters has a variable sub-structure containing several parameter values. Often these values are separated by ‘&’ matching to the message variables &A, &B, etc. of the message definition. If you don’t find an ‘&’ than you will have fixed length parameter values matching to the message variables &n (n is a number describing the count of characters) within the message definition.

Relevant DDIC structures:

RSLGENTR SysLog entry

RSAUENTR2 Security Audit Log Entry Version 2 with Long Terminal Names

Example of an entry in a .aud file:

2AU520130409010803000505200009D9a234ba.pDOKUSTAR                        SAPMSSY1                              0201R&0                                                            h020co.pt.com     

This leads to the following file format:

You see,

• the format of the variable message data
• the message class (logon, transaction start, report start, RFC logon, user master record change, RFC start, miscellaneous, and system)
• the severity (critical, important, non-critical)
• and the monitoring alert settings (with, without)

are not visible within the file, but only in the message definition in table TSL1D (the key fields are AREA and SUBID).

Terminal ID versus IP Address

The Security Audit Log normally logs the terminal id if it’s available; otherwise the IP address is logged. You can set the (undocumented) profile parameter rsau/ip_only to the value 1 to log the IP address instead (if available). See note 1497445 for details.

Use the following options to get the terminal id and the IP address of active users:

• Transaction SM04 shows the IP address of the GUI client as well if you change the layout. (Limited to currently active users.)
• Table USR41 containing the last logon date shows both terminal id and the IP address in field TERMINAL. Maybe it’s possible to activate table logging using SE13 to get the history, too. Than you could merge this data with the log entries.
• Maybe you can try to use user exit SUSR0001 to log IP address (from function TH_USER_INFO and/or table USR41) in a custom table or via creating additional Security Audit Log entries for message AU1 (sucessful logon) for which you e.g. set the parameter &A or a new parameter &B with the IP address. See function RSAU_WRITE_TRAC_AUDIT_LOG to understand how to create such entries. (Limited to dialog logon only.)

There exist strong limitations of logging terminal ID and IP address in ABAP. A malicious user could spoof the terminal ID easily. The IP address can be problematic, too. For example if a reverse proxy (e.g. web dispatcher) for HTTP access is used, then all users will have the same IP address.

(German) Data Protection

Would the German Data protection authorities have an issue with activating this level of logging?

From a general point of view I would start with following assumptions:

1. Filter: Activate everything which is critical for all users ‘*‘ in all clients  ‘*‘.

➙ mostly ok, details should be confirmed

2. Filter: Activate everything for users ‘SAP*‘ in all clients ‘*‘

➙ ok

3. Filter: Activate everything for other support and emergency users, e.g. ‘FF*‘ (FireFighter) in all clients ‘*‘

➙ ok (assuming that you already have agreed on using GRC Super User Management)

4. Filter: Activate all events for the dialog activities ‘logon’ and ‘transaction’ for user ‘DDIC‘ in all clients.

➙ ok

5. Filter: Activate everything for client ‘066‘. This client is not used anymore and can be deleted.

➙ ok

6. Filter: Activate RFC events (AUL, AUK, AU6, AU5) for a short time for selected users to identity RFC connection problems easily

➙ you have to confirm this

7.-10. Filter: free for other project specific purpose

➙ you have to confirm this

Keep in mind that you have to discuss (among others) log creation, consolidation, archiving as well as retention periods and deletion.

Example from a German project (2010/2011) which was cleared through German, Austrian, French & Belgian data controllers:

Logging everything was OK as there is are legitimate reasons for it.  The following additional controls were required:

• Access to logs limited to Basis & Security team
• Acceptable use (of logs) policy circulated to everyone with access
• Data had to be summarized before use (e.g. could not be easily attributable to an individual.  Obviously difficult to achieve if someone is in a team of 1…)
• Distribution of data outside security team had to be approved by local data controller (local to the people who’s data it was).
• Detailed records existing outside the system had to be deleted after the summation work had been completed

Exceptions to these included:

• legitimate use of data in event of security breach (agreed by local counsel and data controllers)
• use of data with written approval of user (we used this a lot when redesigning access based on patterns of ‘model’ users).

I just found an additional recommendation about the protection of the files in a recent note:

In general, files of the Security Audit Log must not be accessed by other ABAP programs than the Security Audit Log application itself. Protect the files by assigning the appropriate S_DATASET authorizations to your users and by using S_PATH protection as described in note 177702. For this purpose, use an own dedicated folder for Security Audit Log files. Enter this directory into the SPTH table and enable the flags FS_NOWRITE and FS_NOREAD, thus disabling any read or write access from ABAP to this directory. Configure the Security Audit Log (parameter DIR_AUDIT) to use this directory.

GRC Fire Fighter logging

The application GRC Access Control Super User Management (aka FireFighter) consolidates logs from various sources:

• Transaction Log: Captures transaction execution from transaction STAD
• Change Log: Captures change log from change document objects (tables CDPOS and CDHDR)
• System Log: Captures Debug & Replace information from transaction SM21
• Security Audit Log: Captures Security Audit Log from transaction SM20
• OS Command Log: Captures changes to OS commands from transaction SM49

Because of this we recommend to define a filter in the Security Audit Log which records all events for fire fighter users.

Performance

Q: Is there a significant performance impact (or any impact at all) if we enable the security audit log with the recommended settings? We’ve had resistance from some clients as they were worried that it will impact on the end user experience / slow down the system.

Unfortunately the FAQ note 539404 does not talk much about performance.

Well, the general rule is simple: There is no performance impact, not in time nor in space, if you log unsuccessful (=critical) events as these events happens rarely.

As soon as you start logging successful events you might look to space – the growing size of the audit files – but still not to time, as the Security Audit Log is optimized for speed.

Ertunga Arsal has written some noteworthy blogs about performance analysis of the Security Audit Log:

• SAP Security Audit Logs: Which event types should I enable? There are 90 of them! And how much disk space do I need?
• SAP Security Audit Logs: Auditor wants me to switch ALL on!!! Here is what I told him

Conclusion: you do not need to care about time, and space is only important if you log specific successful events:

• RFC function called (AUK respective EUE which take >70% of the space)
• Successful RFC logon (AU5 which take >15%)
• Successful Web Service Call (CUV which take >10% if the system uses web services extensively)
• Report started (AUW which take >5%)
• Successful JSON RPC call (DUR)

How to create customer-specific events

Using notes 1941526 and 1941568 you can utilize the custom messages DUX, DUY and DUZ in SAP_BASIS release as of 7.30. Call function RSAU_WRITE_CUSTOMER_EVTS to create these messages.

You can “reuse” other codes, i.e. CUY if you ensure that you still will be able to distinguish the messages. Nevertheless, you should interpret it as a (logical) modification of the SAP Standard.

in addition there exist other options to log custom specific events:

• Application Log in ABAP
• CCMS Alerts
• Alerts send to the SAP Solution Manager

How to read the long texts of events

You can view the long text of Security Audit Log event messages using transaction SE92 (or in transaction SE61 if you choose the document class SL (Syslog).

Using note 1970644 you can get report RSAU_INFO_SYAG which shows all events of the Security Audit Log including the current status of activation. The detail view allows you to create an HTML-based event definition print list including the full documentation.

How to log critical debugger events

Using the debugger in general might already be seen as critical but using debug-change is considered as very critical by all auditors. The corresponding Security Audit Log messages for changing field content and for jumping within the code

• Other Events, Critical, CUL Field content changed: &A
• Other Events, Critical, CU_M Jump to ABAP Debugger: &A

are already covered by the 1st filter “Activate everything which is critical for all users in all clients” as proposed above.

These both messages are extended by another message to add more details describing the event:

• Other Events, Critical, BUZ > in program &A, line &B, event &C

Limitation: debug-display is not logged!

The messages CUK, CUN, CUO, and CUP are related to the debugger as well.

How to track changes on the settings

Dynamic settings

The effective (dynamic) settings get logged in the Security Audit Log itself.

If you create – as recommended – a filter for “all clients, all users, all audit classes with severity ‘critical'” than you already get the corresponding events of audit class “System”:

Static settings

The static settings are stored in table RSAUPROF. The system create table logs for any changes which you can view, i.e using report RSTBHIST.

The name of the active profile which is used while starting an application server is stored in field CURRPROF of the entry with PROFNAME = $CURPROF.

You can transport static profiles using a workbench transport which get transport entries for R3TR TABU RSAUPROF with table key PROFNAME=<profile name> SLOTNO=*. (You can transport the entry for $CURPROF as well, but I recommend to choose the active profile in the target system manually.)

As of SAP_BASIS 7.50 you have to add transport entries for R3TR TABU RSAUPROFEX with table key PROFNAME=<profile name> SLOTNO=*.

The Kernel parameters are stored in the special profiles $KERNEL$, etc.

We do not recommend to transport these parameters because of non-compatible changes between different SAP versions.

As of SAP_BASIS 7.40 you can use transaction SM19 to add static filter definitions to a transport. See FAQ Note 539404 item [8].

The filters are stored in the entries having field SLOTNO > 0.

Field STATUS shows if a filter is active.

Field CLASSES shows the active audit classes. This is a bit-field summing up the values for the different audit classes (see include RSAUCONSTANTS):

CONSTANTS: RSAU_CLASS_OTHER(4)    TYPE x VALUE 1,
          RSAU_CLASS_LOGIN(4)    TYPE x VALUE 2,
          RSAU_CLASS_TASTART(4)  TYPE x VALUE 4,
          RSAU_CLASS_REPORT(4)  TYPE x VALUE 8,
          RSAU_CLASS_RFCLOGIN(4) TYPE x VALUE 16,
          RSAU_CLASS_USER(4)    TYPE x VALUE 32,
          rsau_class_system(4)  type x value 64,
          RSAU_CLASS_RFCCALL(4)  TYPE x VALUE 128.

The audit class “System” is implicitly active and is not added, therefore you get the value CLASSES = 191 = 128 + 32+16+8+4+2+1 if you activate all audit classes.

Field SEVERITY shows the severity (see include RSAUCONSTANTS):

CONSTANTS: RSAU_SEVE_LOW      TYPE I VALUE 2,
          RSAU_SEVE_MED      TYPE I VALUE 5,
          RSAU_SEVE_HIGH    TYPE I VALUE 9.

If you have selected the detail settings, then field SELVAR contains the constant 01 (and field CLASSES = 0 and SEVERITY = 0). Field MSGVECT defines active events. (In this case you can deactivate “System” events.)

Active events are identified using individual bits at specific positions within field MSGVECT. The position is calculated using the alphanumerical order 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ  according to the SUBID of the events. The event area (AU,  BU,  CU, DU, EU) defines the bit which is added to the value on that position: AU = 80 (hex), BU = 40 (hex), CU = 20 (hex), DU = 10 (hex), EU = 08 (hex).

Only the first 36 positions of field MSGVECT are used. Every position holds two bytes therefore you see two hexadecimal characters per position.

Example showing active system events only (AUE AUF AUG AUH AUI AUJ):

MSGVECT  000000000000000000000000000080808080808000000000000000000000000000000000…

SUBID     0 1 2 3 4 5 6 7 8 9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Position -1-2-3-4-5-6-7-8-9–11–13–15–17–19–21–23–25–27–29–31–33–35–…

Change Reporting in the SAP Solution Manager

In addition to the local table logs of table RSAUPROF you can use the applications Change Reporting and Configuration Validation in the SAP Solution Manager to analyse changed settings. Use the configuration store AUDIT_CONFIGURATION. Be aware that the extractor gets a snapshot of the dynamic settings daily – that means it shows the effective settings according to profile parameters respective the overriding kernel parameters. Changes between two executions of the extractor are not cached. The configuration store does not show the user account who triggered the change. Therefore I recommend to use Change Reporting or Configuration Validation as a trigger for deeper analysis of the local table logs.

see: Configuration Validation Home

http://wiki.scn.sap.com/wiki/display/TechOps/ConfVal_Home

➙ Content of CCDB for a Technical System of type ABAP ➙ …

http://wiki.scn.sap.com/wiki/display/TechOps/ConfVal_ABAP_Content#ConfVal_ABAP_Content-AUDIT_CONFIGURATION

What is the meaning of message BU4?

Question: I our productive environment am getting many times the message BU4 “Dynamic ABAP Coding: Event &A Event Type: &B Checksum: &C” but according to your post (and my old screen capture) the BU4 message should be for “Transport Request &A Contains Security-Critical Source Objects“.

I searched but could not find anything about this issue…what do you recommend beside good luck :-)?

Answer: The definition of the message BU4 in transaction SE92 might be still wrong depending on the release of the system. According to note 539404 recording the events to transport security-relevant objects (BU3, BU4) is not yet implemented.

As described in note 1655743, the Kernel creates message BU4 “Dynamic ABAP Coding: Event &A Event Type: &B Checksum: &C” to flag usage of

• ‘I‘ for INSERT REPORT
• ‘G‘ for GENERATE SUBROUTINE POOL
• ‘D‘ for DELETE REPORT

if setting in SM19 at ‘Other entries’ for ‘Audit of generated dynamic ABAP’ is active.

You will get events for message BU4 i.e. whenever transaction SE16 generated a report selection screen for a table which you view using this transaction.

(In addition entries in the db tables DYNABAPHDR and DYNABAPSRC are written if profile parameter abap/dyn_abap_log is set to the value “on“.)

How can I read events using BAPIs?

The security alerts are also available to external programs using BAPIs (Business Application Programming Interfaces). The report RSAU_READ_AUDITLOG_EXTERNAL is a sample SAP program that you can use as a template for accessing the security alerts using BAPIs.

For the Security Audit Log (SAL) you will work with following result fields:

write: /
MSG_LINE_TBL-MSCGLLID(3),    ” SAL Message ID
MSG_LINE_TBL-MSCGLLID+4(14), ” Time stamp (yyyymmddhhmmss)
MSG_LINE_TBL-MSCDATE,        ” Date
MSG_LINE_TBL-MSCTIME,        ” Time
MSG_LINE_TBL-MANDT,          ” Client
MSG_LINE_TBL-USERID,         ” User
XMI_RAW_TBL-MSGID(3),        ” SAL Message ID
XMI_RAW_TBL-MSGARG2,         ” SAL Message parameters seperated by ‘&’
XMI_EXT_TBL-MSG.             ” SAL Message text with parameters

Limitations:
– It seems that you have to address all application servers individually (however, I’m not sure as I’m not an expert for these BAPIs).
– Following fields seem not to be available: Terminal name, Transaction Code, Program, SAP process, Work Process Number

Documentation about using the BAPIs:

Including External System Management Programs in the CCMS Monitoring Architecture (2002)
https://archive.sap.com/documents/docs/DOC-16459

How to get a cross-reference about the creation of messages?

If you want to know which program triggers which message you can use the cross-reference feature of the development environment. Well, messages are no repository objects, therefore you cannot use it directly. However, many but not all messages are triggered by specific functions of methods per scenario. You can use the cross-reference for these triggers.

Have a look to method GET_TRIGGER_FOR_MSG of class CL_INFO_SYAG to view the list of triggers which are used to create audit messages. Then go for the cross-reference in transaction SE80 or SE84 for these functions and methods.

How to avoid logging for Auto-ABAP (SAPSYS) processing

If you do not want to log Security Audit Log events for Auto-ABAP processing (aka “SAPSYS processing”) even if you log all events for user pattern SAP* you can assign a different username to this type of processing by setting following profile parameters:

rdisp/autoabapuser
rdisp/bgrfc_watchdog_user

To define the value for these profile parameters you enter the client, a comma and the user.

Example: 000,ZSAPSYS

This user has to exist in the choosen client with sufficient authorizations!

Create this user with user type B=system, no password and a role which contains at least following authorizations (you may start with full authorizations and use transaction STAUTHTRACE for a while to get the list of required authorizations):

Authorization object S_ADMI_FCD with field S_ADMI_FCD = PADM, ST0R

Authorization object S_BTCH_ADM with field BTCADMIN = Y

Authorization object S_DATASET with fields
ACTVT = 33
FILENAME = *
PROGRAM = RSCORE00, SSFALRTEXP

Authorization object S_RZL_ADM with field ACTVT = 01, 03

This tip was developed by a customer based on information within note 2288530. The customer has an even stronger requirement as mentioned above because they want to log everything in all clients for all users with just the exception to omit logging for Auto-ABAP processing. This customer use a special variation of the trick:

Auto-ABAP processing is executed by user SAPSYS______ (12 characters).

No other user name is longer than 11 characters.

The filter im transaction SM19 for the user name is defined as +++++++++++ (11 characters).

Comparison between old and new transactions as of 7.50

We recommend to use the new functions as soon as they are available for a larger part of the system landscape. Implement note 2743809 before using RSAU_CONFIG – this note contains important corrections.

Old transaction SM19 does not work correctly anymore as soon as you start using RSAU_CONFIG! To avoid using the old functions we recommend to lock the transactions (see note 2234192) and to write a comment into the profile parameter file.

Is it possible to schedule Security Audit Log reports and send them via mail?

Transaction SM20 is a dialog transaction which does not offer scheduling options.

However you can use report RSAU_SELECT_EVENTS or new report RSAU_READ_LOG, which is available as of 7.50, instead. As these are standard reports you can schedule them as an background job, and you can send the results via mail like for any other background job.

—