Risk
Without logs, critical account activity and security changes cannot be reconstructed reliably.
ABAPHANAJavaBTP
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Standard | rsau/enable ; rsau/integrity | 1 ; 1 Enables SAL and integrity protection. |
| ABAP Standard | rsau/log_peer_address ; rsau/user_selection | 1 ; 1 Records peer addresses and enables user selection. |
| ABAP Standard | rsau/selection_slots | ≥ 10 Provides enough filters; equivalents exist in RSAU_CONFIG/SM19. |
| ABAP Standard | SAL · user filters | Full audit of critical accounts SAP* using SAP#*, DDIC considering RDDIMPDP, SAPCPIC and emergency users. |
| ABAP Standard | SAL · general scope | Critical events for all users and clients Check filter activation, not just definitions. |
| ABAP Standard | icm/HTTP/logging_0 ; icm/HTTP/logging_client_0 ; icm/security_log | Enabled with rotation Records HTTP traffic and ICM security events. |
| ABAP Standard | ms/HTTP/logging_0 ; ms/http_logging | Logging enabled; ms/http_logging=1 Records Message Server communication. |
| HANA Critical | global.ini · auditing configuration · global_auditing_state | true Enables HANA auditing. |
| HANA Standard | default_audit_trail_type | SYSLOGPROTOCOL or CSTABLE Do not rely solely on CSVFILE for security-critical auditing. |
| HANA Standard | Audit policies | Configuration, logons, privileges and accounts Set event status, level and user scope appropriately. |
| Java Extended | enable.xml.hardener | true Validates XML from external files in Log Viewer. |
| BTP Standard | Audit logs per subaccount | Regular export to persistent storage Establish retrieval and completeness checks. |
| BTP Standard | Cloud Connector · Audit Log Level | Security Logs rejected requests and critical administrative changes. |
In HANA, audit configuration changes, failed logons, GRANT/REVOKE, user administration and SYSTEM account operations. Select INFO, WARNING and CRITICAL levels according to handling procedures and event volumes.
How to verify
- Check active filters and generate a controlled test event.
- Confirm peer address recording and audit file protection.
- Verify HANA policies and audit destinations.
- Check BTP log export, retention and availability.
Related topics
RFC · SACF: switchable authorization checks ↗