Security & GRCadvanced

Firefighter Logging and Log Review: Building Audit Evidence (Part 4)

Key takeaway

Treat EAM logging as the detective control that makes privileged access accountable: collect session activity, synchronize logs, route them to independent Controllers, investigate exceptions and retain sign-off evidence.

Explanation

📌 KEY POINTS
✅ Emergency access is acceptable only if the privileged activity is actually visible and reviewed.
⚠️ A stale sync job means absent logs are NOT proof that no activity occurred — don't assume silence means nothing happened.
💡 Sign-off must be more than clicking "reviewed" — comments/evidence should explain any anomalies found.

━━━━━━━━━━━━━━━━━━━━
▶ 1. WHAT GETS COLLECTED

Firefighter logon/session info, executed transactions/actions, change activity, other supported log sources
Exact log set depends on configuration and application type

━━━━━━━━━━━━━━━━━━━━
⚠️ 2. THE SYNC RISK

A session can succeed while log collection later fails
If the sync job is stale, absent logs are NOT proof nothing happened — monitor collection jobs and reconcile expected sessions against received logs

━━━━━━━━━━━━━━━━━━━━
▶ 3. WHAT REAL REVIEW LOOKS LIKE

Compare actual actions to the approved request reason
Identify unexpected transactions, sensitive changes, long/unusual sessions, activity outside the incident window
Sign-off needs comments/evidence explaining anomalies — not just a checkbox

━━━━━━━━━━━━━━━━━━━━
▶ 4. OPERATING MODEL

Retention policy must align with audit/legal requirements
Centralized vs. decentralized firefighting can differ in where notifications/log processing happen — document which one you're running

✅ CHECKPOINT: explain why "no logs found" is not the same as "nothing happened."

Real project scenario

An auditor found several Firefighter requests marked complete with no activity logs. Investigation revealed the log-sync job had failed for two days after a connector outage. The company had assumed "no logs = no usage." New monitoring compared Firefighter sessions to synchronized log records and alerted on missing evidence.

Common mistakes

Treating a successful Firefighter login as proof logs were collected.
Rubber-stamping log review.
Allowing the Firefighter to review their own activity.
Ignoring sync-job failures.
Retaining logs for less time than the control/audit requirement.

Best practices

Reconcile sessions to collected logs.
Alert on failed log sync.
Keep Controller independence.
Require comments for anomalies.
Retain evidence according to policy.

Interview angle

Explain the detective-control chain: session -> plugin/source logs -> synchronization -> Controller review -> sign-off/evidence. Strong answers note that missing logs can be an operations failure, not zero activity.

Practice this lesson

Quick check

1. Scenario — An auditor found several Firefighter requests marked complete with no activity logs. For the lesson "Firefighter Logging and Log Review: Building Audit Evidence", which response shows the strongest architecture and production judgment?

2. When a firefighter user performs actions during an emergency access session, what kind of information does the resulting session log typically capture?

3. After a firefighter session ends, whose responsibility is it to review the generated activity log and confirm the actions taken were appropriate?

Interview questions

1. You are the senior consultant/architect responsible for Firefighter Logging and Log Review: Building Audit Evidence. The project situation is: An auditor found several Firefighter requests marked complete with no activity logs. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?

Answer it in your own words first, then compare.

2. You are the senior consultant/architect responsible for Troubleshooting EAM: Synchronization, Missing Logs and Connector Problems. The project situation is: Firefighter sessions worked after an S/4 upgrade, but Controllers received no logs. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?

Answer it in your own words first, then compare.

Practice more with Interview AI →

Reference-verified: the steps are checked against official SAP documentation and tutorials, and object and field names in the sample code are checked for consistency. The code has not been compiled or run on an SAP system by ERPClimb. Syntax marked release-dependent varies by SAP release, so check it in your own system.