Versions Compared

Version Old Version 1 New Version 2
Changes made by

Stephen Bangs

Narender Baderia

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • Transaction Code - This field is mandatory and is used to filter on a specific transaction code that is noted within the security audit log. To extract data from all transactions, enter a wildcard value (i.e. “*”).

  • Client - This field is mandatory and is used to filter on a specific client of the SAP system that is noted within the security audit log. To extract data from all the clients, enter a wildcard value (i.e. “*”).

  • User - This field is mandatory and is used to filter on a specific user that is noted within the security audit log. To extract data for all the users, enter a wildcard value (i.e. “*”).

  • Security Level - This field is mandatory and is used to filter on a specific 'Security Level' message that is noted within the security audit log. To extract data for all security level, enter a wildcard value (i.e. “*”).

  • Grp - This field is mandatory and represents the system log message group. To extract data for all message groups, enter a wildcard value.

  • N - This field is mandatory and represents the message group sub-name. To extract data for all the message group sub-names, enter a wildcard value.

  • Message Text - This field is mandatory and represents the message text from the system log. To extract data for all messages, enter a wildcard value.

  • INCL/EXCL - This field is mandatory and is an exclusion or inclusion criteria. To exclude the values defined in the selection criteria enter an “E“ in the field. Similarly, to include the values defined in the selection criteria enter an “I” in the field.

  • Active - This field is mandatory and is a checkbox used to enable or disable the filter criteria. To activate the filter criteria, ensure the checkbox is checked. Conversely, if you would like to disable data collection ensure the checkbox is unchecked.

Here is an example of what the filter can look like once it is filled out:

...

Splunk Event

The event will look like this in Splunk:

...

The data displayed will match the data collected and sent to Splunk.

...

Field Mapping

Field

Description

Unit of Measure

ALGAREA

System Log: Group of 36 System Log Messages

String

ALGCLIENT

Client

Number

ALGDATE

SecAudit: Date audit entry created

YYYYMMDD

ALGFILENO

SysLog: File number

Number

ALGFILEPOS

SysLog: File offset

Number

ALGINST

SAP Instance Name

String

ALGLTERM

SecAudit: Terminal name

String

ALGREPNA

Program Name

String

ALGSUBID

System log: Third character of message name

String

ALGSYSTEM

Server Name

String

ALGTASKNO

Work process number

Number

ALGTASKTYPE

System log: SAP process name

String

ALGTCODE

Transaction Code

String

ALGTEXT

SecAudit: Text part of displayed Security Audit Log message

String

ALGTIME

SecAudit: Time at which audit entry was created

HHMMSS

ALGUSER

User Name in User Master Record

String

CURRENT_TIMESTAMP

The date time stamp when the information was collected

YYYYMMDDHHMMSS

EVENT_SUBTYPE

String

EVENT_TYPE

SM20

String

IPADDRESS

Terminal

IP Address

PARAM1

SysLog: variable message data

String

PARAM2

SysLog: variable message data

String

PARAM3

SysLog: variable message data

String

PARAM4

SysLog: variable message data

String

TXSEVERITY

System audit log: Security level text format

String

TXSUBCLSID

System audit log: Security class text format

String

UTCDIFF

The UTC OFFSSET in HHMMSS that the data was collected in

HHMMSS

UTCSIGN

The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.

+ | -