Deleting Old Audit Files

Use

The Security Audit Log saves its audits to a corresponding audit file on a daily basis. Depending on the size of your SAP System and the filters specified, you may be faced with an enormous quantity of data within a short period of time.

We recommend archiving your audit files on a regular basis and deleting the original files as necessary.

Use this procedure to delete old audit files. You can either delete the files from all application servers or from only the local server where you are working. If an application server is not currently active, it will be included in the next reorganization.

This procedure only deletes the audit log file(s)! It does not perform any other administrative tasks such as archiving. If archives are necessary for future references, you must manually archive them before deleting.

You cannot purge files that are less than 3 days old!

Procedure

1. To access the Security Audit Log reorganization tool from the SAP standard menu, choose Tools à Administration à Monitor à Security Audit Log à Reorganization.

The Security Audit: Delete Old Audit Logs screen appears.

2. Enter the Minimum age of files to delete (default = 30 days).

This value must be > 3.

3. Activate the To all active instances indicator to delete the audit files from all application servers. Leave the indicator blank if you only want to delete the files from the local application server.
4. Activate the Simulation only indicator if you do not actually want to delete the files. In this case, the action is only simulated.
5. Choose Audit Log à Continue.

Result

The system deletes the corresponding audit files (unless you chose to simulate). You receive a list showing how many files were deleted and how many were retained on each application server.