Search code examples
securityloggingauditsap-basis

Are SAP Security Audit Logs (SAL) encrypted?

after hours of googling it, I still can't find an answer. Would some SAP Expert please tell me: Is it possible, that SAP SAL are generated as encrypted files or are they without encryption?

Is it possible e.g., to parse the audit log files with a 3rd party tool or some coding in Python, Java, etc.?

The context of my question is IT Compliance. I am trying to understand, if it is necessary to encrypt SAP SAL Log archives (in case they are unsafe).

Thanks.

Solution

  • Nope, man. They are not encrypted.

    Just now I enabled logs in SM19 and downloaded a couple of AUD-files from Application Server to my PC. That is how they look like:

    2AUJ20190502225613000730800000D0hostname1 SAPUSER1 SM19 SAPMSM19 10021 hostname1 2AUE20190502225613000730800000D0hostname1 SAPUSER1 SM19 SAPMSM19 1002 hostname1 2AUI20190502225613000730800000D0hostname1 SAPUSER1 SM19 SAPMSM19 10021 hostname1 2AUI20190502225613000730800000D0hostname1 SAPUSER1 SM19 SAPMSM19 10022 hostname1 2AUE20190502225613000730800000D0hostname1 SAPUSER1 SM19 SAPMSM19 1002 hostname1 2AUI20190502225613000730800000D0hostname1 SAPUSER1 SM19 SAPMSM19 10021 hostname1 2AUE20190502225613000730800000D0hostname1 SAPUSER1 SM19 SAPMSM19 1002 hostname1 2AUI20190502225613000730800000D0hostname1 SAPUSER1 SM19 SAPMSM19 10022

    The format is following:

    <date><hostname> <sap_user> <runned_tcode> <some_techcode>

    Yes, formatting is a bit weird, without line breaks, but is is a matter of taste.

    So they are plain-text and perfectly parsable.