How to Audit at the User Level in SAP

Creating a User Audit Profile

Step-by-Step Process

1. Log on to any client in the appropriate SAP system.
2. Navigate to transaction SM19.
3. On the Security Audit: Administer Audit Profile screen, click on Profile → Create from the top menu bar.
4. In the Create new profile popup, provide a unique Profile Name and click the Enter (green check mark) icon.
5. Under the Filter 1 tab: 
• Check the box labeled Filter active to activate the filter.
• In the Selection criteria section, select the desired Clients and User names for tracing.
• In the Audit classes section, activate all necessary auditing functions for this profile.
• In the Events section, choose the desired level of auditing by clicking the appropriate radio button.
6. Once all required details are entered, click the Save icon. A message stating "Audit profile saved" will appear in the status bar.
7. Important: The user trace profile is saved but not activated. Proceed to the activation process to enable it.

Activating a User Audit Profile

Step-by-Step Process

1. Log on to any client in the appropriate SAP system.
2. Navigate to transaction SM19.
3. On the Security Audit: Administer Audit Profile screen: 
• Select the desired audit profile from the Profile dropdown menu.
• Click the Activate (lit match icon) to enable the profile.
4. A message stating "Audit profile activated for next system start" will appear in the status bar.
5. Note: Auditing will only commence after the SAP instance is restarted.
6. You can now exit the SM19 transaction.

Viewing the Audit Analysis Report

Step-by-Step Process

1. Log on to any client in the appropriate SAP system.
2. Navigate to transaction SM20.
3. On the Security Audit Log: Local Analysis screen, provide the necessary details for analysis: 
• Fill in the Selection, Audit classes, and Events to select sections as required.
• To trace a specific user, include that user's ID.
• Click the Re-read audit log button to retrieve the results.
4. A comprehensive list of audit logs will be displayed. You can print the list using standard SAP printing methods.
5. You can now exit the SM20 transaction.

Best Practices for User-Level Auditing

• Regularly review and update user audit profiles to match your organization's security policies.
• Schedule periodic checks of the audit logs to detect unusual or unauthorized activities.
• Ensure that the audit profile activation is properly aligned with your SAP instance restart schedules.
• Maintain a clear documentation process to track changes and updates to audit profiles.

Common Errors and Troubleshooting

• Audit Profile Not Activated: Ensure the profile is activated before restarting the SAP instance. Recheck settings under transaction SM19 if the profile is not functioning.
• Audit Log Not Displaying Data: Verify that the profile is active and correctly configured under SM19. Ensure the correct filters are applied when retrieving data via SM20.
• Insufficient Permissions: Verify that the user has the necessary authorizations to access transactions SM19 and SM20.

Conclusion

FAQs

1. What is the purpose of user-level auditing in SAP? 

2. How often should I review audit logs? 

3. Can I modify an existing audit profile? 

4. Why is my audit profile not collecting data? 

5. Can I export audit logs to external tools for analysis? 

6. What precautions should I take while auditing users? 

This guide ensures that you can successfully audit users within SAP, enhancing security and maintaining compliance. Start implementing these steps today for a more secure SAP environment.

See Also
Stopping The OS Level Service

Get help for your Basis problems
Do you have a SAP Basis Question?

SAP Basis Admin Books
SAP System Administration, Security, Authorization, ALE, Performance Tuning Reference Books

SAP Basis Tips
SAP BC Tips and Basis Components Discussion Forum

Administration In SAP - Sapgui, Unix, SAP ITS, Router, Client Copy and IDES 

Main Index
SAP ERP Modules, Basis, ABAP and Other IMG Stuff