The system trace shows what SAP actually did: which authorization checks ran and failed, which RFC calls were made, which database operations were executed. sapaudit keeps trace results next to the rest of the audit trail, so a finding can be followed down to the check that allowed or refused it.
Each check with its object, the values tested and whether it passed or failed.
Calls between systems: the function called, the calling user and the destination.
Table access performed during the traced activity.
Low-level events for the cases where the application view is not enough.
Search the trail in ordinary terms and keep the searches you repeat as reports.
Sage AI learns the normal pattern for each user and system here, and raises what falls outside it.
A function is called from a destination that has never called this system before.
One user fails checks on many unrelated objects in a short time, as if probing for what is allowed.
A technical account starts doing things only dialog users normally do.
A short evaluation shows what your trail looks like within the first day.
Request a demo