SAP AuditLog Monitor

Monitoring of the SAP ABAP Security Audit Log (transaction SM20/RSAU_READ_LOG) depending on different filters or predefined presets.

General

Executable	SAP_AuditLog_Monitor.exe
Connection method	RFC
Ports	33$$ 48$$ (SNC) ($$ = Instance number)

Default parameters

Parameter name	Possible values	Default	Description
Host	<ip> | <hostname>	empty	Hostname or IP of the target system. If you use a virtual hostname on your SAP servers, please use also the virtual host to connect.
SAPSID	string (3) | XXX	empty	SID of the SAP system
SAPInstance	number (2) | 00 - 99	empty	Instance number of the SAP system
SAPClient	number (3) | 000 - 999	empty	SAP Client (CLNT/MANDT). Only audit log events of this client are read.
SAPUsername	string	empty	SAP user
SAPPassword	string	empty	Password of the SAP user

Sensor-specific parameters

Parameter name	Possible values	Default	Description
Preset	NONE | <filename>	NONE (no preset)	Preset file in folder SAP_AuditLog_Monitor which defines the parameters Minutes, Events, Users, Tcodes, Programs and Instances (see Presets). The extension .preset can be omitted.
Minutes	1 - 1440	60	Past minutes to check
Events	<event1>[,<event2>[,<event3>,...]] | FILE:<filename>	* (all events)	Filter for audit log events / message IDs, e.g. AU2 (* can be used as wildcard)
Users	<user1>[,<user2>[,<user3>,...]] | FILE:<filename>	* (all users)	Filter for users (* can be used as wildcard, use #* for a literal *, e.g. SAP#*)
Tcodes	<tcode1>[,<tcode2>[,<tcode3>,...]] | FILE:<filename>	* (all transaction codes)	Filter for transaction codes (* can be used as wildcard)
Programs	<program1>[,<program2>[,<program3>,...]] | FILE:<filename>	* (all programs)	Filter for programs (* can be used as wildcard)
Instances	<instance1>[,<instance2>[,<instance3>,...]] | FILE:<filename>	* (all instances)	Filter for application server instances (* can be used as wildcard)

The filters Events, Users, Tcodes, Programs and Instances can also be read from a file in folder SAP_AuditLog_Monitor with FILE:<filename>. The file contains one value per line, lines starting with # or // are ignored.

Presets

A preset file contains one parameter per line in the format <parameter>=<value>. Lines starting with # or // are comments. Allowed parameters are Minutes, Events, Users, Tcodes, Programs and Instances; a value can also be FILE:<filename>.

# Failed logons in the last 15 minutes
Events=AU2,AU6,AUO,BU1,AUM
Minutes=15

Sensor parameters which differ from their default (* for filters, 60 for Minutes) override the value of the preset. This way a preset can be narrowed down, e.g. Preset=Failed_Logons with Users=FF_*.

The following presets are delivered:

Preset	Content
Failed_Logons	Failed logons (AU2, AU6, AUO), failed password checks (BU1) and users locked after incorrect logons (AUM)
Emergency_Users	All events of the users SAP*, DDIC, EARLYWATCH and TMSADM
User_Admin	User created/deleted/locked/unlocked (AU7, AU8, AU9, AUA, AUN), authorizations and user master changed (AUB, AUD) and password changes (BU2)
Audit_Config_Changes	Changes of the Security Audit Log configuration (AUE, AUF, AUI, AUJ)

info

Preset files will be overwritten during update of Scansor. If you want to customize a file, please copy and rename it.

Channels

Channel name	Description	Lookup file
Audit Log Events	Count of audit log events depending on the given filters. The sensor message lists the distinct events with their users.

Important notes

warning

The events have to be activated in the Security Audit Log configuration (transaction SM19/RSAU_CONFIG), otherwise they are not written to the log and cannot be monitored.

warning

Depending on the monitored system and the audit configuration, the count of entries in the audit log can be huge. Check sensor execution time at command line with option --time to get an estimation. Then you can maintain the sensor timeout setting in PRTG to avoid errors. If execution time is too long, decrease parameter “Minutes”. The sensor doesn’t have predefined limits.

warning

Please check the channel limits in PRTG if they fit for your alerting.

Troubleshooting

Error Code	Error Message	Possible Solution
[SCN-107-000]	The following parameters has not been provided: <parameters> Please read the sensor documentation for further information!	Specify the listed parameters in the profile or in the sensor-specific parameters.
[SCN-107-051]	Parameter "Minutes" is not a correct integer value!	Specify a number between 1 and 1440 in the parameter Minutes.
[SCN-107-052]	Parameter "Minutes" cannot be more than 1440 (24h)!	Specify a number between 1 and 1440 in the parameter Minutes.
[SCN-107-054]	RSAU_API_GET_LOG_DATA failed: <exception> <message>	The function module raised an ABAP exception. Check that the Security Audit Log is active (transaction RSAU_CONFIG) and that the RFC user is authorized to read it (authorization object S_SAL).
[SCN-107-055]	RSAU_API_GET_LOG_DATA failed: <message>	Check that the function module RSAU_API_GET_LOG_DATA exists (SAP_BASIS 7.50 or higher) and that the RFC user is authorized to call it (authorization object S_RFC, function group RSAU_LOG).
[SCN-107-056]	RSAU_API_GET_LOG_DATA returned errors: <messages>	The function module returned error messages. Check the messages and the filter parameters of the sensor.
[SCN-107-057]	The file <file> could not be found! Please check your sensor parameters!	Check the name of the preset or FILE: parameter and that the file exists in folder SAP_AuditLog_Monitor of the custom sensors directory.
[SCN-107-058]	Invalid line "<line>" in preset file <preset>! Allowed keys are <keys>.	Each line of a preset file must have the format <parameter>=<value> with one of the allowed parameters.
[SCN-107-100]	RFC Connection error: <message>	Check the SAP connection parameters (Host, SAPInstance, SAPSID, SAPClient, SAPUsername, SAPPassword) and that the SAP system is reachable from the PRTG probe. The message from SAP tells you the cause (e.g. wrong password, locked user, missing authorization for RFC).

Changelog

Version	Changes
2026.10	First release