SLG1 — Application Log Display
SLG1 is the transaction that reads and displays the generic Business Application Log, a shared logging store that many SAP programs, batch jobs, and interfaces write into. It is a viewer, not a generator: nothing appears unless the calling program explicitly created and saved a log entry under a specific object and subobject key.
This page covers how SLG1 fits into incident diagnosis for batch jobs and interfaces that complete without a dump but still fail on business logic, and how to search a shared log store that is populated by unrelated applications using their own object and subobject keys. It also covers the tables behind the display, retention behaviour, and the recurring false negatives consultants hit when a program never persists its log.
Reviewed by an ERPClimb SAP consultant on 15 Sept 2026· 1,181 words
What it does
SLG1 displays entries from the Business Application Log, a generic logging framework that any ABAP program can call to record structured messages during processing. The transaction itself does no logging; it queries the underlying log tables and renders whatever the calling program chose to write, using an object and subobject key that the writing program defines. The structural fact that explains most confusion is that hundreds of unrelated applications, from IDoc processing to custom Z-programs, share the same log tables and the same viewer transaction. Two consultants debugging completely different processes both end up in SLG1, and if the object/subobject is not known in advance the log list can be enormous and irrelevant. Finding the right entry depends entirely on knowing, or discovering, which key the specific application used when it wrote the log.
When it is used
SLG1 gets used when a background job or interface finishes without a short dump and without an obviously failed job status, but the business result is wrong or incomplete. Typical cases: a mass update run that skipped certain records silently, an IDoc or proxy interface that processed but logged warnings the calling system never surfaced, or a report that ran to completion but wrote detailed error text into the application log instead of the job log. It is reached for after checking job status and before assuming the process is a mystery, because many standard programs deliberately push detail into SLG1 rather than the spool or job log. Fiori apps built for a specific business object sometimes expose a filtered log view of the same underlying data, but for cross-application or ad hoc analysis SLG1 remains the direct route to the raw log.
How to use it
- Start SLG1 in display mode
- Enter object and subobject if known from documentation or program source, otherwise leave broad
- Restrict the time window tightly around the incident, since object/subobject alone can return thousands of entries across all users
- Add user name or external ID if the process is known to tag logs that way
- Execute and review the header list, then expand each entry to see the message tree
- Double click a message line to read the long text and any attached context values
- Note the exact object and subobject once located, for direct filtering next time
Key fields
- BALHDR - log header record: object, subobject, external ID, creating user, date and time, and expiry date used by cleanup jobs
- BALM - individual log messages: message class, number, type (error, warning, info), and message text variables
- BALC - context container data attached to a message, holding additional structured information the writing program chose to pass
- BALDAT - underlying storage for log data in some formats, generally not queried directly but present in the data model
How to prove it in the data
Start in BALHDR filtered on OBJECT and SUBOBJECT plus the creation date and time fields to isolate the run in question, and note the LOGNUMBER of the candidate header. Then query BALM filtered on that LOGNUMBER, checking MSGTY to isolate errors and warnings versus pure informational noise. If the header exists but no rows appear in BALM, the program opened a log but never wrote messages to it, which is itself diagnostic. If no header exists at all for the time window, the process never created a log or it has already been deleted by retention cleanup.
ECC vs S/4HANA
SLG1 and the underlying Business Application Log framework are unchanged on S/4HANA; the transaction, the table structure, and the object/subobject model carry over directly from ECC. There is no general-purpose Fiori replacement for browsing the log framework itself, though individual Fiori apps built around a specific business object may present a curated view of the same log entries relevant to that object. For anything outside those curated views, SLG1 remains the tool.
Common pitfalls
- Unfiltered search flooding the result: leaving object and subobject blank and searching a wide date range returns an unmanageable list where the relevant entry is buried among unrelated applications; always narrow by time first, then widen the key search only if nothing matches
- Log deleted by retention cleanup: application logs carry an expiry date and are periodically purged by a standard housekeeping job; if the incident being investigated is older than the retention window, the log is gone permanently and reproducing the scenario is the only remaining option
- Log opened but never saved: some custom or standard programs create a log handle and add messages in memory but skip the call that actually persists and closes the log, so SLG1 shows nothing even though the program clearly ran; this looks identical to no logging having occurred and has to be ruled out by checking the program logic, not by searching harder in SLG1
- Green job status masking a real problem: a background job can finish with a fully successful status in the job monitor while the application log underneath carries warning or error messages that were never escalated to job level; do not treat a clean job status as proof the process behaved correctly
- Ambiguous concurrent runs: mass processing that spawns parallel work processes often writes multiple logs under the identical object and subobject at nearly the same time; without filtering by user, external ID, or a narrower time window it is easy to open the wrong instance and draw the wrong conclusion
- Authorization gaps read as absence of data: a user lacking display authorization for a given log object gets an empty result that looks identical to no log existing; confirm authorization before concluding nothing was recorded
Whose problem this is
First stop for the functional or interface consultant investigating a specific business process failure, since the content is business-specific message text. It becomes a Basis or ABAP problem only when the framework itself misbehaves, such as logs not saving, retention deleting too aggressively, or table growth affecting performance. A good handover includes the object, subobject, external ID if any, exact time window, and the expected versus actual message severity.
Related SAP objects
Reviewed pages this object connects to in the ERPClimb knowledge graph.
Source: ERPClimb — https://erpclimb.com/sap-tcodes/slg1ERPClimb is an independent platform and is not affiliated with SAP SE. Reference pages are written and reviewed by SAP consultants for learning and troubleshooting.