SAP GRC Access Control

Superuser privilege management

(aka Firefighter)

Table Change Log Details

 GRC Access Control - Firefighter - Log data changes

The logging flag defines whether changes to the data records of a table
should be logged. If logging is activated, every change (with UPDATE,
DELETE) to an existing data record by a user or an application program
is recorded in a log table in the database.

Note: Activating logging slows down accesses that change the table.
First of all, a record must be written in the log table for each change.
Secondly, many users access this log table in parallel. This could cause
lock situations even though the users are working with different
application tables.

© SAP AG 2007, Title / First Name Last Name / 2

 Log data changes Dependencies

„ Logging only takes place if parameter rec/client in the system profile is

set correctly. Setting the flag on its own does not cause the table
changes to be logged.

„ The existing logs can be displayed with Transaction Table history

(SCU3).

© SAP AG 2007, Title / First Name Last Name / 3

 Firefighter – Table change log enabling: TA SCU3

© SAP AG 2007, Title / First Name Last Name / 4

 Firefighter – Sample – Tables are enabled for logging

© SAP AG 2007, Title / First Name Last Name / 5

 Firefighter - Log data changes Evaluate

© SAP AG 2007, Title / First Name Last Name / 6

 Firefighter – Sample table like MARA

© SAP AG 2007, Title / First Name Last Name / 7

 Firefighter – Technical Information of Log of MARA

© SAP AG 2007, Title / First Name Last Name / 8

 Firefighter – Technical Information of Log of MARA – it is
inactive

© SAP AG 2007, Title / First Name Last Name / 9