orkungedik/SAP-basis-dataset huggingface dataset:
## 6.3.1.16.2.5  How to Exclude Specific Users from Read Access Logging
## Context
You cannot exclude specific users from Read Access Logging by using the app Read Access Logging Configuration.
## Procedure
- To let users be excluded from Read Access Logging, please contact the Service Center.
## 6.3.1.16.2.6  How to Check Runtime Errors and See Changes to Configurations
## Context
The Administrative Log of Read Access Logging provides information about different types of information such as:
- Action - changes made to Read Access Logging configuration.
- Error - errors that occur within the Read Access Logging framework.
## Action Log Entries
The action log records the following Read Access Logging changes:
- Configuration
- User exclusion list
- Enabling and disabling of Read Access Logging in the current client
##  Note
Only configuration changes performed manually are recorded in the log. Configurations that have been transported into the system are not included in the Administrative Log.
## Error Log Entries
Error entries could be errors in the configuration, or problems that occur during logging. The log entry may recommend action to resolve the error and/or provide other information relevant for key users or SAP Active Global Support.
## Procedure
1. In the app Read Access Logging Configuration, open Administrative Log .
2. Select a Data Source , either the database or the archive.
3. For Databases , specify a time filter. For Archives , select the Archive Name .
4. Enter a User Name to search the log for configuration actions or read access performed by a specific user.
5. Specify a log Type for archives or Event Type for databases ( Error , Warning , Message , Action or Logging Error ).
## 6.3.1.16.2.7  Transporting Read Access Logging Data
RAL objects that you've created can be transported from a Q system to a P system (development system to production system) with the Export Customizing Transports app
In your RAL application, you can create different customizing objects like configurations or recordings. These objects are added to the default customizing request that you can export from a Q system and import into a P system. The objects that come from the RAL application are:
- Configurations Refer to SAP note 2963664 for details.
- Log domains
- Purposes
- Recordings
To transport your changes from the development system to the productive system, perform the following steps:
## In your development system:
1. Use the Manage Software Components app to make sure there is a cloned business configuration software
2. component. See Manage Software Components. In case it is not available yet, you need to create a business configuration software component and clone it.
3. See How to Create Software Components and How to Clone Software Components.
2. Make sure that there is an open customizing transport request for your system and that the customizing
5. transport request belongs to the cloned business configuration software component. To create a customizing transport request, you use the Export Customizing Transport app. You need the SAP\_BR\_BPC\_EXPERT role to access this app. See Export Customizing Transports [page 2695]. If a software component of the type Business Configuration is available in the system, the created request will target this software component. If no such software component is available, the request will be created without any target.
3. Make the actual changes to the RAL objects.
4. Release the task and customizing transport request in the Export Customizing Transport app.
## In your productive system:
1. In the Manage Software Components app, pull the changes for the business configuration. See How to Pull Software Components.
2. Check in the Read Access Logging Configuration app if the changes are visible.
## Related Information
Working in the Export Customizing Transports App [page 2697]
## 6.3.1.16.3  Read Access Logging: Monitor
With this app you can use the read access log for evaluation purposes. In it, all log entries as well as all errors that occurred in Read Access Logging are displayed.
## Key Features
You can use this app to:
- Choose a data source
- Search for log entries
- Evaluate log entries
## Prerequisites
To access the app, you need to have the SAP\_CORE\_BC\_RAL business catalog assigned to your user. This business catalog is contained in the SAP\_BR\_DATA\_PRIVACY\_SPECIALIST business role template.
## Supported Device Types
- Desktop
- Tablet
- Smartphone
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-SEC-RAL .
## 6.3.1.16.3.1  How to Monitor the Read Access Log
## Context
You use the read access log for evaluation purposes. In it, all log entries as well as all errors that occurred in Read Access Logging are displayed. There are the following data sources from which you can display log entries:
- Expanded Database (default)
- Expanded Archive
- Raw Database
Only contains the Read Access Logging data of the current client.
- Raw Archive
Archive of the raw database.
- Raw Archive with Index Indexed archive of the raw database.
## Procedure
1. Open the Read Access Logging: Monitor app.
2. Select the data source from which you want to display log entries.
3. Search for the log entries you want to evaluate.
To search for values of fields that have been accessed, you must use the Expanded Database as the source.
For data source Archive , select the archive in which you want to search for log entries. Additionally, there are various search criteria that you can use (choose the Add Line icon). Typically, you would search for a time range and a log domain or a logging purpose. These search criteria are also available if you search using the database as the source.
<!-- image -->
##  Note
Searching the archive may be time-consuming. It is much faster if you search an archive with an index. In this case, the search criteria that you have specified for the index are available.
When you choose Search , all log entries are displayed that match your search criteria. By default, only a few attributes are displayed per log entry. You can switch between the default and the extended view.
Within the search, you can clear the values you have entered for search criteria by choosing Clear , and you can reset the search criteria to the default by choosing Reset .
##  Note
You can use the button Download at the top left of the search result table to save your search results in an Excel file.
## Search Operators: 'is' vs. 'covers' .
In many search functions within SRALMANAGER and SRALMONITOR , two comparison operators are available:
- 'is' : Used for an exact match . The entered value must exactly match the stored value.
<!-- image -->
##  Example
Searching for Status is "Open" will return only entries with the exact status Open .
- 'covers' : Used for a pattern-based search with wildcards . The most common wildcard is "*" , which represents any sequence of characters.
```
 Example Searching for Name covers "Error" will return all entries whose name starts with Error* , such as Error123, Error - Timeout , etc.
```
These operators allow for flexible data filtering depending on the desired level of precision.
4. Select a log entry to display detailed information at the bottom.
On the Details tab, all fields are displayed with their log domain and, if logged, the field values. On the Access Environment tab, you find more information about the underlying object that was logged.
## 6.3.1.16.4  Integrating Read Access Logs
Service name: SRAL\_API\_RAW\_LOG
This service enables you to retrieve the raw Read Access Logs. You can use the log data to integrate them into your Security and Event Management solution (SIEM) to detect security relevant event situations.
## Technical Details
| Service Group (incl. Name- space if Existent)   | Repository ID   | Service Name (incl. Name- space if Existent)   |   Version |
|-------------------------------------------------|-----------------|------------------------------------------------|-----------|
| SRAL_API_RAW_LOG                                | SRVD_A2X        | SRAL_API_RAW_LOG                               |      0002 |
## Service Structure
## Service Header (optional)
The service header contains information about the service.
## Entities
The entities contain the business data of the service.
| Entity           | Description                    | Necessity   | Link to Details                 |
|------------------|--------------------------------|-------------|---------------------------------|
| ReadAccessLogRAW | Read Access Log in RAWfor- mat |             | Read Access Logging [page 2833] |
## Service Response
The details included in the response vary according to the type of operation. For more information, see Operation for Read Access Log Integration.
## Integration with SIEM Solution
Service name: SRAL\_API\_RAW\_LOG
Communication scenario: SAP\_COM\_0915
This service enables you to retrieve the raw Read Access Logs. You can use the log data to integrate them into your Security and Event Management solution (SIEM) to detect security relevant event situations.
## 6.3.1.16.4.1  Operations for Read Access Log Integration Read
The Read Access Log Integration - Read offers the following operations:
| Operation                              | HTTP Method   | HTTP Method                                                                                                                                                           |
|----------------------------------------|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Retrieving Read Access Log [page 2864] | GET           | Example getting the first 1000 audit log entries: GET <host>/sap/opu/ odata4/sap/ sral_api_raw_log_04/ srvd_a2x/sap/ sral_api_raw_log/0002/ ReadAccessLogRAW?top=1000 |
Example getting the first 1000 audit log entries:
## 6.3.1.16.4.1.1  Retrieving Read Access Log
With Read Access Log you can retrieve the Read Access Log by using the HTTP method GET .
## Request
You have to include the following properties in the URL of the request:
| Property     | Property   | Comment                                                                                      |
|--------------|------------|----------------------------------------------------------------------------------------------|
| LogID        | Optional   | Unique identfier of each logt • String($uuid) Example: 01234567-89ab- cdef-0123-456789abcdef |
| LogTimestamp | Optional   | Timestamp of the read access log event • String($date-time) Example: 2017-04-13T15:51:04     |
| Property   | Property   | Comment                                                           |
|------------|------------|-------------------------------------------------------------------|
| slgmand    | Optional   | Client within the SAP System • String <=3 characters Example: 100 |
| sid        | Optional   | System ID • String <=3 characters Example: YI3                    |
| counter    | Optional   | Message counter • integer($int16)                                 |
| slgtc      | Optional   | Transaction Code • String <=20 characters Example: VA01           |
| slgrepna   | Optional   | ProgramName • String <= 40 characters Example: SAPMSSY8           |
## Response
The operation returns the Read Access Log.
## Example
## Get events within a specific timeframe:
```
GET <host>/sap/opu/odata4/sap/rsau_log_api/srvd_a2x/sap/rsau_log_api/0001/ ReadAccessLog? $filter=(log_tstmp%20ge%202021-05-08T10%3A25%3A09Z%20and%20log_tstmp%20le%202021-
```
05-09T10%3A25%3A09Z)
## Response
```
{ "eventID": "AU1", "log_tstmp": "2021-05-08T10:26:22.740611Z", "slgmand": "100", "sid": "ABC", "counter": 0, "terminal_name": "", "user_fullname": "Example Administrator", "slgtc": "S000", "slgrepna": "RSBTCRTE", "rsau_text": "Logon successful (type=B, method=A)",
```
```
"UserDescription": "Example Administrator" }, { "eventID": "AU1", "log_tstmp": "2021-05-08T10:28:22.924215Z", "slgmand": "100", "sid": "ABC", "counter": 0, "terminal_name": "", "user_fullname": "Example Administrator", "slgtc": "S000", "slgrepna": "RSBTCRTE", "rsau_text": "Logon successful (type=B, method=A)", "UserDescription": "Example Administrator" },
```
## 6.3.1.17  Security
```
Secure Communication [page 2866] Display Security Audit Log [page 2882]
```
## 6.3.1.17.1  Secure Communication
SAP BTP ABAP environment offers secure communication features for securing both machine-to-machine communication (server communication security) as well as communication between systems and end-user UIs (frontend communication security).
Communication security is maintained on multiple levels.
## Establishing the Communication Channel to a Host
The connection is initiated by a client calling a host to set up a cryptographically secured communication channel. This is known as a TLS (or SSL) handshake. During the handshake, the host proves its identity by presenting a server certificate. The client validates the server certificate to gain assurance that the connected host coincides with the host the client intended to call. This prevents man-in-the-middle attacks.
In case of a web UI, the validation of server certificates is done in the browser using a list of trusted root certificates provided by the browser or the operating system.
The certificate of your system is signed by DigiCert Global Root CA.
In other cases, the client may also be a backend server talking to another backend server. Here, the server initiating the connection takes the role of the client and the other one is the host.
## Authentication of the Client/User
After the communication channel is established, the application on the host side may verify the caller's identity if the application requires authentication. The most common method for this is still basic authentication (user/password). A more secure option is certificate-based authentication (mTLS). Here, the client presents an X.509 certificate to the application to prove its identity.
## Additional Protection of Web Clients
For web clients, there are additional mechanisms protecting the user from attacks like cross site scripting (XSS) or redirect attacks. These mechanisms are defined by the server, but enforced in the user's client.
## 6.3.1.17.1.1  Frontend Communication Security
Communications between the customer browser and the system landscapes of SAP BTP ABAP environment are secured by industry best practices and state-of-the-art open cryptographic standards. Customers use a unique, customer-specific URL. Communication is carried out via the Reverse Proxy (RP) component. The communication channels are secured by using Transport Layer Security (TLS) protocol version 1.2.
Client-side security controls implemented by the browser and by SAP BTP ABAP environment mitigate the risk of various attacks, including cross-site scripting, data injection, and clickjacking.
Some of these controls can be configured with allowlists such as the following:
- Trusted sources of scripts, stylesheets, and fonts can be added to the default Content Security Policy.
- Trusted hosts can be defined for the clickjacking protection, and for safe redirects.
## 6.3.1.17.1.1.1  Content Security Policy
Content Security Policy (https:/ /www.w3.org/TR/CSP3 ) is a standard which allows you to disable certain HTML/JavaScript features to reduce the attack surface of applications running in a browser (for example, as a second line of defense against cross-site scripting attacks). The policy explicitly lists all allowed sources from where resources (scripts, styles and fonts) can be loaded.
Servers can define different content security policies (CSPs) for different paths (applications) and different resource types to provide very granular control.
CSPs can be defined in reporting or blocking mode. In reporting mode, a violation will be reported to a URI specified within the CSP. In blocking mode, violations are not only reported but execution of violating code or loading of the violating resource is additionally blocked by the browser.
## Related Information
Manage Content Security Policy [page 2873]
## 6.3.1.17.1.1.2  Clickjacking Protection
Clickjacking (or UI redressing) is a type of attack that tricks the user into triggering actions within an application by hijacking mouse clicks or other user inputs.
In the simplest attack scenario, an invisible iFrame containing the attacked page is positioned over an attackercontrolled page. The user thinks the UI is original and is unaware of the actual actions triggered on the invisible page in the frame. To protect against this attack, you need to control whether to render your application within a frame and which pages are allowed.
The allowlist service is an ABAP-wide service and supports HTML-based frameworks to implement protections. By default, clickjacking protection is active.
As soon as the protection is enabled, a special check is performed every time an application is rendered. If the application is embedded into another one, the check determines whether the other application is secure. If the check fails, the embedded application is not framed. An error message appears.
An application is considered secure if one of the following applies:
- The application itself is not embedded in another frame
- The host of the application is part of the same domain as the embedding applications (same origin policy).
- The host of the application is part of the allowlist. For multi-domain scenarios, you have to make sure that the host name of the application in which your application is embedded, is part of the allowlist.
## Related Information
Maintain Protection Allowlists [page 2870]
## 6.3.1.17.1.1.3  Trusted Network Zones
## Redirection Attacks
The primary use of trusted network zones is to prevent redirection attacks.
In a redirection attack, the attacker tricks the victim into sending a specially crafted request to the server. The server then redirects the request to a malicious website based on the information in the request.
This is used for phishing. The victim might not be aware of the redirect because the initial request was sent to a trustworthy system and the malicious site might be built to resemble the trustworthy system.
The configuration of trusted network zones prevents such attacks by limiting which URLs the server can redirect to.
## Upload Limitation
The trusted network zones configuration also restricts uploads defined by URL.
Where file upload is possible by specifying a URL rather than a file on the filesystem, the entered URL is checked against the trusted network zones list. Note that host, port, and scheme of the URL must be maintained in Trusted Network Zones for the upload to be permitted.
## Related Information
Maintain Protection Allowlists [page 2870]
## 6.3.1.17.1.1.4  Session Timeout
Both web applications in the SAP Fiori Launchpad and in SAP Cloud Identity Services - Identity Authentication log out users after a certain period of inactivity. The length of this period can be changed independently for the two.
## SAP Fiori Launchpad
Users are automatically signed out from the SAP Fiori Launchpad after a period of inactivity that is configurable in the Manage Launchpad Settings app.
##  Note
The following timeout parameters are visible in the Manage Launchpad Settings app. If you need to make changes, we suggest you keep the value of the SESSION\_TIMEOUT\_INTERVAL\_IN\_MINUTES parameter synchronized with the timeout in your Identity Authentication tenant so as to avoid inconsistencies in session management.
- SESSION\_TIMEOUT\_INTERVAL\_IN\_MINUTES
- SESSION\_TIMEOUT\_REMINDER\_IN\_MINUTES
- SESSION\_TIMEOUT\_STOP\_DATA\_REFRESH
## Related Information
Manage Launchpad Settings Signing In and Signing Out Configuring the Automatic Sign-Out Configure Session Timeout (SAP Cloud Identity Services - Identity Authentication)
## 6.3.1.17.1.1.5  Apps for Configuring Frontend Communication Security
The following apps are used for configuring frontend communication security:
- Maintain Protection Allowlists [page 2870]
- Manage Content Security Policy [page 2873]
## 6.3.1.17.1.1.5.1  Maintain Protection Allowlists
With this app you can maintain a list of trusted hosts or URL patterns.
With this app you can define secure applications by adding trusted hosts to allowlists. The following allowlists are available as separate tabs in the app:
- Clickjacking Protection By default, clickjacking protection is active to protect your systems against malicious clickjacking. If the allowed as a framing parent (that means it is allowed to embed the UI within frames in external pages). To
system is embedded into another application, the check determines whether the other application is add trusted hosts, you have to enter specific details, such as schema and port, for each trusted host to make sure that malicious hosts are identified and prevented from calling your system.
- Trusted Network Zones Here you can list URL patterns for which a redirect is allowed or blocked. Trusted network zones
configuration also restricts uploads defined by URLs.
## · Trusted CSS Style Sheets
Here you can list URL patterns for loading CSS style sheets. This may be necessary if customer extensions are using external CSS style sheets.
- Cross-Origin Resource Sharing Here you can add trusted hosts using Cross-Origin Resource Sharing. For more information, see the
- Related Information section.
## Key Features
You can use this app to:
- Add trusted hosts to the required allowlist
- Edit trusted hosts or URL patterns
- Delete trusted hosts or URL patterns
##  Note
You can also define wildcards if required, such as *test.com .
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-SRV-APS-COM .
## Related Information
How to Add Trusted Hosts for Cross-Origin Resource Sharing (CORS) [page 2872]
## 6.3.1.17.1.1.5.1.1  How to Add Trusted Hosts for Cross-Origin Resource Sharing (CORS)
## Context
CORS is a mechanism that allows web browsers or other web clients access to your sites. Access of this kind is usually forbidden by the Same-Origin-Policy (SOP). To add trusted hosts using CORS, proceed as follows:
## Procedure
1. Open the Maintain Protection Allowlists app on the SAP Fiori Launchpad.
2. Open the Cross-Origin Resource Sharing tab.
3. Enter the Trusted Host Name (SAP Analytics Cloud, for example, could have the following pattern: mytenant.us1.sapbusinessobjects.cloud ).
4. Enter the HTTP Service Path (for example /sap/opu/odata/sap/APS\_IAM\_API\_BROLE\_CDOC ).
5. Select the allowed HTTP methods .
6. Enter the allowed headers (for example content-type )
Only the following response headers are generally accessible in a CORS query:
- Cache Control
- Content Type
- Last Modified
- Content Language
- Expires
- Pragma
If the server wants to give the client access to further headers, it has to use the Exposed Headers option.
7. In addition, you can define exposed headers under Optional Response Headers if required. Please select the required checkboxes.
8. Click Add .
## Related Information
Understanding the Same-Origin Policy and CORS
## 6.3.1.17.1.1.5.2  Manage Content Security Policy
Content Security Policy is a standard that allows to disable certain HTML/ Javascript features to reduce the attack surface of applications running in a browser (for example as second line of defense against cross-site scripting attacks).
With this app you can view an allowlist of trusted sources. You can add your own trusted content for example if you have developed your own SAPUI5 app that loads external resources such as fonts, scripts or styles. Moreover, you can display any violations of the policy in a log.
## Key Features
You can use this app to:
- Display an allowlist of trusted sources
- Add new trusted sources to the allowlist For fonts, use UI\_RESOURCES\_FONTS; for scripts, use UI\_RESOURCES\_SCRIPTS, for styles, use UI\_RESOURCES\_STYLES.
- Display logs listing violations Please note the following information about browser-related effects that in some cases might result in additional violations while in other cases violations are not listed:
- The violation logs might contain records indicating that an EVAL violation has occurred. These violations can be ignored. They are caused by unexpected behavior in Google Chrome.
- Firefox does not send the session cookie with the reporting requests. These requests will therefore be rejected by the backend, and are thus not included in the log.
- Browser extensions sometimes insert non-policy conform code into an HTML page. This results in violation log entries that are not caused by the applications themselves.
##  Note
You can switch the reporting endpoint delivered by SAP on and off. To do this, activate or deactivate the Reporting Endpoint Status switch on the Settings tab.
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-MID-ICF .
## 6.3.1.17.1.2  Server Communication Security
In integration scenarios, the SAP BTP ABAP environment backend exchanges data with other systems. These systems may be SAP or third-party systems in the cloud or on-premise.
To secure these system-system communication channels, authentication based on certificates can be used.
We distinguish between outbound and inbound integrations.
## Outbound Integrations
In outbound integrations, the SAP BTP ABAP environment calls an external system. To establish the connection, the external system must present a trusted (server) certificate.
The SAP BTP ABAP environment may in turn authenticate towards the external system by presenting a client certificate that the external system trusts. Depending on the capabilities and configuration of the external system, other authentication methods like OAuth or user/password are possible.
## Inbound Integrations
In inbound integrations, an external system calls the SAP BTP ABAP environment backend system. The authentication method is specified as part of the communication arrangement. In case of certificate-based authentication, the external system must present a specific certificate that is maintained in the communication arrangement and signed by an approved CA.
## 6.3.1.17.1.2.3  Apps for Configuring Server Communication Security
The following apps are used for configuring server communication security:
- Maintain Certificate Trust List [page 2878]
- Maintain Client Certificates [page 2879]
## 6.3.1.17.1.2.3.1  Maintain Certificate Trust List
With this app you can maintain a list of trusted certificates. If certificates of communication partners are classified as trusted, outbound communication to these partners can be enabled.
With this app you can monitor all available trusted certificates.
## Key Features
You can use this app to:
- Display a list of all already existing trusted certificates
- Upload a new certificate
- Display detailed information
- Check for updates of certificate trusts and adopt the changes if required.
- Automatically apply all changes to the SAP trust list in your trust list after an upgrade. You can either just add new certificates or add new certificates and simultaneously remove deleted certificates.
- Delete trusted certificates from the list. This feature is enabled only for the certificate type Managed By Customer . Certificates of the type Managed By SAP cannot be deleted and therefore the Delete button is disabled.
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-SRV-APS-COM .
## 6.3.1.17.1.2.3.2  Maintain Client Certificates
With this app you can upload client certificates for your area to enable secure outbound certificate-based authentication. You can maintain one central list of certificates you can use when defining communication systems for outbound communication.
## Key Features
You can use this app to:
- Upload certificates in PKCS #12 format
- Download certificates
- Display general information and usage in communication arrangements and systems
- Replace client certificates
- Create signing requests
## Note:
Once you have uploaded your certificate in the Maintain Client Certificates app, you have to edit it to enable it for usage in SAP BTP . Y ou do this by selecting Client Default for ABAP on BTP in the Certificate Category dropdown.
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-SRV-APS-COM .
## Related Information
Communication Arrangements [page 2711]
## 6.3.1.17.1.2.3.2.1  Using Client Certificate Authentication with SAP BTP Destination Service
To enable client certificate-based authentication in SAP BTP ABAP environment, the following prerequisites have to be met:
SAP BTP cockpit:
## For Web Socket RFC
1. Select your Web Socket destination within your used destination service.
2. Under Additional Properties , apply the jco.client.tls\_client\_certificate\_logon property and set it to value 1 .
3. Choose Save .
## For HTTP
1. Select your HTTP destination within your used destination service.
2. In the Authentication dropdown list of the Destination Configuration area, select Client Certificate Authentication .
3. Choose Save .
## 6.3.1.17.2  Display Security Audit Log
With this app, you can display information about security-relevant events that occur in your SAP system. This can be necessary in case of an audit.
## Key Features
This app provides the following key features:
- Recording of security-relevant events in your SAP system.
- Access to previously specified log files in the form of an audit analysis report.
## Scope
The Security Audit Log records the following information:
- Security-related changes to the ABAP Platform (for example, change of system changeability)
- Information that provides a higher level of transparency (for example, successful and unsuccessful logon attempts)
- Information that enables the reconstruction of a series of events (for example, successful or unsuccessful transaction starts)
The app Display Static System Audit (available for the external auditor role) displays a detailed list of the Security Audit Log events, which are visible in the Security Audit Log app. SAP Note 2903873 provides a list of currently recorded Security Audit Log events.
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, report an incident under component BC-SEC-SAL .
## 6.3.1.17.2.1  Integrating Security Audit Logs
Service name: RSAU\_LOG\_API
This service enables you to retrieve the security audit log data. You can use the audit log data to integrate them into your Security and Event Management solution (SIEM) to detect security relevant event situations.
This is an OData version 4 service. This version aims to improve processing time and resource consumption of clients and servers. This includes a lightweight JSON format that reduces the size of every response.
## Technical Details
A service group contains services belonging to the same business object model and so it shares similar environment conditions. This means the configuration and administration of a service group apply to all services in a service group, that is, routing, authorization, and so on, so you only have to do them once.
In the OData version 4 (V4) runtime implementation of the SAP Gateway Foundation, framework services originate from repositories.
| Service Group (incl. Name- space if Existent)   | Repository ID   | Service Name (incl. Name- space if Existent)   |   Version |
|-------------------------------------------------|-----------------|------------------------------------------------|-----------|
| RSAU_LOG_API                                    | SRVD_A2X        | RSAU_LOG_API_SERVICE                           |      0001 |
## Service Structure
## Service Header (optional)
The service header contains information about the service.
## Entities
The entities contain the business data of the service.
| Entity             | Description        | Necessity   | Link to Details                           |
|--------------------|--------------------|-------------|-------------------------------------------|
| Security Audit Log | Security Audit Log |             | Retrieving Security Audit Log [page 2885] |
## Service Response
The details included in the response vary according to the type of operation. For more information, see Operation for Security Audit Log Integration.
## Integration with SIEM Solution
Service name: RSAU\_LOG\_API
Communication scenario: SAP\_COM\_0750
This service enables you to retrieve the security audit log data. You can use the audit log data to integrate them into your Security and Event Management solution (SIEM) to detect security relevant event situations.
## Additional Information
##  Note
For more details about Communication Management, see Communication Management [page 2707].
## 6.3.1.17.2.1.1  Operations for Security Audit Log Integration Read
The Security Audit Log Integration - Read offers the following operations:
| Operation                                 | HTTP Method   | Sample URL                                                                                                                                                 |
|-------------------------------------------|---------------|------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Retrieving Security Audit Log [page 2885] | GET           | Example getting the first 1000 audit log entries: GET <host>/sap/opu/ odata4/sap/rsau_log_api/srvd_a2x/ sap/rsau_log_api/0001/SecurityAudi- tLog?$top=1000 |
## 6.3.1.17.2.1.1.1  Retrieving Security Audit Log
With SecurityAuditLog you can retrieve the Security Audit Log by using the HTTP method GET .
## Request
You have to include the following properties in the URL of the request:
| Property   | Necessity   | Comment                                                                                      |
|------------|-------------|----------------------------------------------------------------------------------------------|
| eventID    | Optional    | Security Audit Log Event • String <= 3 characters Example: AU1, AU2                          |
| log_tstmp  | Optional    | Timestamp of the security audit log event • String($date-time) Example: 2017-04-13T15:51:04Z |
| slgmand    | Optional    | Client within the SAP System • String <=3 characters Example: 100                            |
| sid        | Optional    | System ID • String <=3 characters • Example: YI3                                             |
| Property   | Necessity   | Comment                                                  |
|------------|-------------|----------------------------------------------------------|
| counter    | Optional    | Message counter • integer($int16)                        |
| slgtc      | Optional    | Transaction Code • String <= 20 characters Example: VA01 |
| slgrepna   | Optional    | ProgramName • String <= 40 characters Example: SAPMSSY8  |
## Response
The operation returns the Security Audit Log.
## Examples
## Get events within a specific timeframe:
```
GET <host>/sap/opu/odata4/sap/rsau_log_api/srvd_a2x/sap/rsau_log_api/0001/ SecurityAuditLog? $filter=(log_tstmp%20ge%202021-05-08T10%3A25%3A09Z%20and%20log_tstmp%20le%20202105-09T10%3A25%3A09Z)
```
## Response
```
{ "eventID": "AU1", "log_tstmp": "2021-05-08T10:26:22.740611Z", "slgmand": "100", "sid": "ABC", "counter": 0, "terminal_name": "", "user_fullname": "Example Administrator", "slgtc": "S000", "slgrepna": "RSBTCRTE", "rsau_text": "Logon successful (type=B, method=A)", "UserDescription": "Example Administrator" }, { "eventID": "AU1", "log_tstmp": "2021-05-08T10:28:22.924215Z", "slgmand": "100", "sid": "ABC", "counter": 0, "terminal_name": "", "user_fullname": "Example Administrator", "slgtc": "S000",
```
```
"slgrepna": "RSBTCRTE", "rsau_text": "Logon successful (type=B, method=A)",
```
```
"UserDescription": "Example Administrator" },
```
## 6.3.1.18  System Management
Maintain User Sessions [page 2887]
## 6.3.1.18.1  Maintain User Sessions
With this app you can view all sessions containing locks in the current system. You can also display further information, such as associated business users. If required, you can delete a session, for example if it is blocking an app.
##  Caution
Please note that it is not possible to delete sessions that are related to drafts.
## Key Features
You can use this app to:
- View details of the sessions, such as user IDs, user names, or number of locks
- Delete sessions if required
##  Note
Please note that the business user does not get a warning message when a session is deleted. Therefore, we recommend that you do this with caution.
The following business catalog is required to make this app visible:
System Management - Sessions ( SAP\_CORE\_BC\_CST\_DP\_MAS\_PC )
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-SRV-APS-IAM .
## 6.3.1.19  Technical Monitoring
Application System Overview [page 2888]
HANA Table Analysis [page 2889]
Sampled Work Process Data [page 2890]
HANA Thread Samples [page 2890]
System Workload [page 2891]
System Outbound Communication [page 2892]
Capture Request Statistics [page 2892]
Perform System Sizing [page 2893]
Health Monitoring [page 2894]
Schedule Metric Provider Collection [page 2895]
Partition HANA Tables [page 2895]
ABAP Runtime Errors [page 2897]
HANA Memory Analysis [page 2898]
SQL Statement Analysis [page 2899]
## 6.3.1.19.1  Application System Overview
## App ID: F4031
With this app you can get access to a set of essential data to monitor the application system.
## Key Features
This app provides the following key features:
- Navigation to detail views, such as memory utilization, work process utilization, dialog step times, and top transactions by CPU utilization
- Thumbnail previews of essential application system metrics
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-OP-MON .
## More Information
The application system overview is part of the technical monitoring cockpit. For more information about the technical monitoring cockpit, see the documentation at https:/ /help.sap.com/viewer/tmc\_cloud.
## 6.3.1.19.2  HANA Table Analysis
App ID: F8726
With this app you can get in-depth information about tables, for example, about their characteristics and resource consumption.
## Key Features
This app provides the following key features:
- View of the total memory consumption of the biggest tables
- Identification where you should optimize the tables and indexes in your system, for example, to save disk space
- For a selected table, detailed information about partitions, indexes, memory, and load
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-OP-MON .
## 6.3.1.19.3  Sampled Work Process Data
## App ID: F4031
With this app, you can check, for example, how much ABAP CPU time and main memory your work processes have consumed and find out the dialog and background work process utilization. This helps you to identify the top consumer workloads that might slow down your system and cause bottlenecks.
## Key Features
This app provides the following key features:
- Identification of resource utilization and main workload
- Analysis of concurrent workload
- Detail views of single work process samples
- Analysis of the root cause of an identified expensive workload or a bottleneck by further drilling down to single code lines via sampled stack traces
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-OP-MON .
## 6.3.1.19.4  HANA Thread Samples
## App ID: F4031
With this app, you can estimate how much HANA CPU time your custom applications consume. This helps you to identify your top workload that consumes most of the HANA CPU time, from where you can drill down to a detailed view of HANA thread samples and the related single SQL statements.
## Key Features
This app provides the following key features:
- Identification of main workload for HANA CPU utilization
- Detail views of single HANA thread samples
- Analysis of the root cause of expensive workload or resource bottlenecks by drilling down to the ABAP coding that triggered the database activity
- Navigation to the SQL statement that triggered the thread activity
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-OP-MON .
## 6.3.1.19.5  System Workload
App ID: F4031
With this app you can get an overview of your system workload and see how it behaves over time.
## Key Features
This app provides the following key features:
- Response time distribution in terms of, for example, CPU, database, and processing times
- Time series of the response time distribution of the system
- Drilldown to request processing details and ABAP statistics records
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-OP-MON .
## 6.3.1.19.6  System Outbound Communication
App ID: F4031
With this app you can get an overview of the system outbound communication over time, which helps you identify obvious expensive outbound communication.
## Key Features
This app provides the following key features:
- It shows the top 10 communication scenarios by calling time.
- The System Outbound Communication screen and its related drill-down screens provide sample records of expensive system outbound communication.
- Outbound communication of type RFC, HTTP, and Web service is supported.
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-OP-MON .
## 6.3.1.19.7  Capture Request Statistics
## App ID: F5699
With this app you can capture request statistics to find out which activities are running in your ABAP system. With the activation of a capture profile, you can capture system activities. Requests are recorded with technical information, such as response time, program name, or CPU time. Using the request statistics, you can investigate the performance of a system or of a tenant in more detail.
## Key Features
This app provides the following key features:
- Creation of capture profiles that define which request statistics are captured when, and whether they are stored locally or are exported
- Display of profiles for capturing request statistics defined by SAP
- Activation and deactivation of profiles for capturing request statistics
- Navigation to the analysis of request statistics
- Activation and deactivation of SQL traces
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-OP-MON .
## 6.3.1.19.8  Perform System Sizing
## App ID: F5700
With this app, you can calculate how many ABAP compute units are consumed based on captured request statistics of selected business scenarios. With the result of the system sizing, you can estimate how many ABAP compute units the production system will need.
## Key Features
This app provides the following key features:
- Navigation from the definition of profiles for capturing request statistics to system sizing based on these statistics
- Estimation of required total ABAP memory, work process time, and ABAP CPU time in ABAP compute units for selected ABAP statistics records
- Fine-tuning of system sizing by changing the selected ABAP statistics records, the process executions per minute, or the available ABAP compute units
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-OP-MON .
## 6.3.1.19.9  Health Monitoring
App ID: F6967
With this app you can check the health of your ABAP system. The KPIs and time series of various metrics are displayed on individual cards. These metrics indicate the health state of the system.
## Key Features
This app provides the following key features:
- Overview of the metrics for the monitored system Health metrics are represented by cards with a KPI that summarizes the current status.
- Display of the history of the metrics to, for example, compare trends, identify performance bottlenecks, or investigate resource shortages
- Navigation to related apps from some cards for further analysis or issue fixing
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-OP-MON .
## 6.3.1.19.10  Schedule Metric Provider Collection
## App ID: F7021
With this app you can schedule and monitor application jobs that collect metric providers that have been created in ABAP Development Tools (ADT) using ABAP for Cloud Development. After you've scheduled your application job and set up the communication to SAP Cloud ALM, your metrics will also be available in SAP Cloud ALM Health Monitoring.
## Key Features
This app provides a view on the Application Jobs app. Therefore, its key features are identical with the key features of the Applications Jobs app.
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-OP-MON .
## Related Information
Application Jobs [page 2674]
## 6.3.1.19.11  Partition HANA Tables
## App ID: F5466
With this app you can break down large columnar tables into partitions. By default, database tables on SAP HANA are not partitioned. The SAP HANA database allows for a maximum number of approximately two billion records per table. If this threshold is exceeded, your application stops working. To avoid this, you need to partition your tables in time.
## Key Features
This app provides the following key features:
- Search for large tables that can be partitioned according to certain filter criteria
- Partition large tables
- Undo the partitioning of a table by merging the partitions of a table back into one table
##  Note
With this app you can only partition your own tables or tables that have explicitly been classified for partitioning by SAP.
## Supported Device Types
- Desktop
- Tablet
## Component for Customer Incidents
If you need support or experience issues, please report an incident under component BC-OP-MON .
## More Information
For more information about the partitioning limits of the SAP HANA database, see SAP Note 2154870 and Partitioning Limits.