SAP Audit Logs Import

[Shubhamjain27]

Hi,

We have a requirement to get the Audit logs and customer has suggested to use RSAU_READ_LOG table.

We have SAP ECC connector.

Now, to get the Audit logs, based on the document https://docs.saviyntcloud.com/bundle/SAP-v23x/page/Content/Importing-Audit-Data.htm

It is mentioned to add AUDIT_LOG_JSON for ECC and use SFTP to get the file to a location from where the Saviynt can fetch the data.

My question is, do we need to use the SFTP or just by adding the AUDIT_LOG_JSON in the ECC connector will do the job?

If we have to do the both, then how the connector is going to know that the data has been loaded and where the data is being loaded?

[rushikeshvartak · Accepted solution]

perform the following steps to import audit logs into Saviynt:

1. For SAP ECC, audit log is generated in a file and is placed at the path defined in IM_FILE_PATHproperty. Create a SFTP process to fetch the file from SAP ECC and place it in the SFTP location.

2. Create a SFTP connection in EIC to connect to the SFTP server and fetch the audit file. The property FILES_TO_GET in the SFTP connection should be mentioned as follows. For details about creating SFTP connection, see the SFTP File Transfer Integration Guide:

   JSON

   [
     {
       "eic_dest_dir":"DataFiles/Logstash",
       "src_dir":"/download/SAP",
       "regex_list":["^.*\\.txt"]
     }
   ]

   Note

   Update the src_dir value to the reflect the SFTP location where the audit file is fetched and stored.

3. Create and Schedule File Transfer job to fetch the files from SFTP location to Saviynt. Once the job runs successfully, audit data is pushed to the SAP audit logs elasticsearch index.
   
   

you need both SFTP will pull log files from sap ecc and then load in elastic search of saviynt