SAP Security Audit Log Activation

As of Release 4.0, you can use the Security Audit Log to record security-related system information such as changes to user master records or unsuccessful logon attempts. This log is a tool designed for auditors who need to take a detailed look at what occurs in the SAP System. By activating the audit log, you keep a record of those activities that you specify for your audit. You can then access this information for evaluation in the form of an audit analysis report.
The Security Audit Log provides for long-term data access. The audit files are retained until you explicitly delete them. Currently, the Security Audit Log does not support the automatic archiving of the log files; however, you can manually archive them at any time.

You can record the following information in the Security Audit Log

• Successful and unsuccessful dialog logon attempts
• Successful and unsuccessful RFC logon attempts
• RFC calls to function modules
• Changes to user master records
• Successful and unsuccessful transaction starts
• Changes to the audit configuration

SAP Security Audit Log Activation Steps

1 – Create Profile

Tcode > SM19

2 – Active Filter

Tcode > SM19

You can choose audit criteria with Filters.

3 – Profile Configuration

Tcode > RZ10

You have to set rsau/enable parameter to 1 to active security audit log for all time.

You have to restart SAP Instances to active profile changes.

You can show audit logs with tcode SM20 , You can delete old logs with the transaction SM18 .
Source : SAP Offical Documents