SAP S/4HANA Administration · Access Protection, Data Security & Auditing

An auditor asks for evidence of who logged on and changed user masters last quarter, but the security audit log was only turned on this week. What does the SAL actually capture, and what's the timing gotcha?

Answer locked. Get the free KnowCard app to reveal it — plus spaced-repetition review so it actually sticks.

This is one card from the KnowCard library — thousands more across SAP, Linux, Python and more. In the app you get the answer, AI explanations, and cards that come back right before you would forget them. Free to start on iOS, Android or the web.

More in Access Protection, Data Security & Auditing

Disk is filling with security audit log files. Why must you never delete them directly from the OS, and how does the system know if you did?

You need an audit filter change that will persist across restarts vs. one just for a short investigation. Which is static, which is dynamic, and what's the trap?

Web clients are getting access denied and you suspect ACL or filtered-object rejections. Which log captures that, and what kinds of events does it hold that the security audit log does not?

Someone proposes enabling table-change logging on master and transaction tables 'to catch every change.' Why is that the wrong target, and where do you read the logs you do keep?

To neutralize SAP*, an admin deletes the SAP* user. Why does that make things worse, and what's the correct procedure?

You open SM19/SM20 to configure and read the security audit log and they behave oddly. What replaced them, and which new transaction does each old job map to?

Start learning today

Free to start — download the app or use it in your browser.