Audit Logs

Lessons in this topic

• SAP Security Audit Log: SM19/SM20, Event Selection and RetentionConfigure and review the ABAP Security Audit Log as a targeted evidence source for security-relevant logon, user, authorization and system events, with governed retention and monitoring.
• Security Audit Log FundamentalsLearn what the ABAP Security Audit Log records, why event selection and retention matter, and how security teams use the log as evidence rather than as a replacement for business context.

Interview questions covered

• What are the core concepts of Audit Logs, and how would you explain them clearly in an SAP interview?
• How would you apply Audit Logs in a real SAP project? Walk through the design or implementation approach.
• A production issue is reported in Audit Logs. What would you check first, and how would you troubleshoot it systematically?
• What are the most important design decisions, trade-offs, and best practices in Audit Logs?
• Suppose you inherit an existing Audit Logs solution. How would you review it before making a change?
• Using this SAP project situation — Configure logging for failed privileged logons, then review events and correlate them with a known test account to understand what the log can and cannot prove — explain Security Audit Log Fundamentals. What should happen, which concepts or process steps matter, and what common mistake would you avoid?
• You are the senior consultant/architect responsible for SAP Security Audit Log: SM19/SM20, Event Selection and Retention. The project situation is: An incident investigation needed failed privileged logons from six weeks earlier, but local audit retention was only seven days and no SIEM forwarding existed. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?

Related topics

Interview questions on this topic

• SAP Security & GRC interview questions