The Security Audit Log is the record SAP keeps of logons, started transactions and security events. sapaudit collects it from every system, keeps it for as long as your policy requires, and makes it readable by people who do not live in SM20.
Successful and failed dialog, RFC and background logons, with the user, the client and the terminal.
Which transaction codes and reports each user started, and when.
User locks, password changes, changes to the audit configuration itself and other events the log classifies as critical.
The same view over development, quality and production, instead of one SM20 session per system.
Search the trail in ordinary terms and keep the searches you repeat as reports.
Sage AI learns the normal pattern for each user and system here, and raises what falls outside it.
A user starts a table-maintenance or debugging transaction they have never used before, in production.
A dialog user signs in at a time and from a terminal that match nothing in their history.
A few attempts on each of hundreds of accounts: invisible per user, obvious in aggregate.
A short evaluation shows what your trail looks like within the first day.
Request a demo