Hello ,
We've configured security autid via parameters below :
rsau/max_diskspace/per_day: 1996800K
rsau/max_diskspace/local 2048000K
rsau/max_diskspace/per_file 665600K
rsau/enable 1
rsau/selection_slots 30
rsau/local/file D:\usr\sap\FKP\DVEBMGS00\log\++++++++.AUD
FN_AUDIT ++++++++######.AUD
DIR_AUDIT D:\usr\sap\FKP\DVEBMGS00\log
In our production system and we repaired security audit screens with abap consultants . Then we could activate audit log for 30 slots . It works very well . We restarted system several times and we didn't get any problem about security configuration .
After a few months , we restarted the system and the slots which we add later changed to inactive .You can see SM20 logs below :
Application Server Stopped
Application Server Started
Audit Configuration Changed
Audit: Slot 1: Class 191, Severity 2, User USER1, Client 200,
Audit: Slot 2: Class 191, Severity 2, User USER2 , Client 200,
Audit: Slot 3: Class 191, Severity 2, User USER3, Client 200,
Audit: Slot 4: Class 191, Severity 2, User USER4, Client 200,
Audit: Slot 5: Class 191, Severity 2, User USER5, Client 200,
Audit: Slot 6: Class 191, Severity 2, User USER6, Client 200,
Audit: Slot 7: Class 191, Severity 2, User USER7, Client *,
Audit: Slot 8: Class 191, Severity 2, User USER8, Client *,
Audit: Slot 9: Class 191, Severity 2, User USER9, Client *,
Audit: Slot 10: Class 191, Severity 2, User USER10, Client *,
Audit: Slot 11 Inactive
Audit: Slot 12 Inactive
Audit: Slot 13 Inactive
Audit: Slot 14 Inactive
Audit: Slot 15 Inactive
Audit: Slot 16 Inactive
Audit: Slot 17 Inactive
Audit: Slot 18 Inactive
Audit: Slot 19 Inactive
Audit: Slot 20 Inactive
Audit: Slot 21 Inactive
Audit: Slot 22 Inactive
Audit: Slot 23 Inactive
Audit: Slot 24 Inactive
Audit: Slot 25 Inactive
Audit: Slot 26 Inactive
Audit: Slot 27 Inactive
Audit: Slot 28 Inactive
Audit: Slot 29 Inactive
Audit: Slot 30 Inactive
We didn't change any parameters or audit configuration before restart but as I said , after restart audit configuration has changed.
Does anyone has an idea about why audit configuration has changed ?
Thanks & Regards
Ozlem Otunctemur