Logs (Java)
Data Description
The Logs event is used in SAP to view log data from the Java NetWeaver systems. Six types of log file are supported:
- Portal Activity: These logs are generated by SAP Enterprise Portal systems 
- Default Trace: These logs are generated by SAP Netweaver AS systems 
- Application: These logs are generated by SAP Netweaver AS systems 
- Config Changes: These logs are generated by SAP Netweaver AS systems 
- Security: These logs are generated by SAP Netweaver AS systems 
- Security Audit: These logs are generated by SAP Netweaver AS systems 
Potential Use Cases
This event could be used in the following scenarios:
- Alert on specific errors in the default trace log. 
- Visualize user activity in the Enterprise Portal system. 
- View specific application logs. 
- Alert on suspicious user activity. 
- Correlate configuration changes to performance issues. 
PowerConnect Administrative Console Configuration
Important: These settings should not be changed without first consulting support.
Log into the PowerConnect administrative console via the following URL (http://<serverhost>:<port>/webdynpro/resources/com.powerconnect5/spcj_wd/SapPowerConnectJava#). Then click on the Log Monitoring tab.

The screen will look like this:

Below is the list of configuration options presented in the Log Monitoring window.
Important: These settings should not be changed without first consulting support.
| Name | Description | Restart of PowerConnect Required | Default | 
|---|---|---|---|
| Portal Activity Log File Directory | Directory on the filesytem where the Portal Activity logs are stored | Yes | ./portalActivityTraces | 
| Portal Activity Log Filename Filter | Regex pattern matching Portal Activity log filenames | Yes | portalActivity_.* | 
| Portal Activity Log File Header | Comma separated list of field names which are mapped to each line in the log | Yes | TimeRequest, LoggedOnUser HASH, iView PCD HASH, Header of Request HSSH, HURL Query String HASH, Time to Process Request, ServerNode, TimeToProcessRequest, HTTPSessionID, NavigationPath, ObjectType, ServerHost, UniqueID, URLQueryString | 
| Default Trace Log File Directory | Directory on the filesytem where the Default Trace logs are stored | Yes | ./log | 
| Default Trace Log Filename Filter | Regex pattern matching Default Trace log filenames | Yes | defaultTrace_.* | 
| Default Trace Log File Header | Comma separated list of field names which are mapped to each line in the log | Yes | Unknown1, Time, Timezone, Severity, SourceName, Unknown2, CSNComponent, DCComponent, Unknown3, CorrelationID, Application, Location, User, Session, Transaction, DSRRootContextID, DSRTransaction, DSRConnection, DSRCounter, ThreadName, Unknown4, Unknown5, Text | 
| Application Log File Directory | Directory on the filesystem where the Application logs are stored | Yes | ./log | 
| Application Log Filename Filter | Regex pattern matching Application log filenames | Yes | applications_.* | 
| Application Log File Header | Comma separated list of field names which are mapped to each line in the log | Yes | Unknown1, Time, Timezone, Severity, SourceName, Unknown2, CSNComponent, DCComponent, Unknown3, CorrelationID, Application, Location, User, Session, Transaction, DSRRootContextID, DSRTransaction, DSRConnection, DSRCounter, ThreadName, Unknown4, Unknown5, Text | 
| Config Changes Log File Directory | Directory on the filesystem where the configuration change logs are stored | Yes | ./log/system | 
| Config Changes Log Filename Filter | Regex pattern matching Config change log filenames | Yes | configChanges_\d+.\d+.log | 
| Config Changes Log File Header | Comma separated list of field names which are mapped to each line in the log | Yes | Unknown1,Time,Timezone,Severity,SourceName,Unknown2,CSNComponent,DCComponent,Unknown3,CorrelationID,Application,Location,User,Session,Transaction,DSRRootContextID,DSRTransaction,DSRConnection,DSRCounter,ThreadName,Unknown4,Unknown5,Text | 
| Security Log File Directory | Directory on the filesystem where the security logs are stored | Yes | ./log/system | 
| Security Log Filename Filter | Regex pattern matching security log filenames | Yes | security_\d+.\d+.log | 
| Security Log File Header | Comma separated list of field names which are mapped to each line in the log | Yes | Unknown1,Time,Timezone,Severity,SourceName,Unknown2,CSNComponent,DCComponent,Unknown3,CorrelationID,Application,Location,User,Session,Transaction,DSRRootContextID,DSRTransaction,DSRConnection,DSRCounter,ThreadName,Unknown4,Unknown5,Text | 
| Security Audit Log File Directory | Directory on the filesystem where the security audit logs are stored | Yes | ./log/system | 
| Security Audit Log Filename Filter | Regex pattern matching security audit log filenames | Yes | security_audit_\d+.\d+.log | 
| Security Audit Log File Header | Comma separated list of field names which are mapped to each line in the log | Yes | Unknown1,Time,Timezone,Severity,SourceName,Unknown2,CSNComponent,DCComponent,Unknown3,CorrelationID,Application,Location,User,Session,Transaction,DSRRootContextID,DSRTransaction,DSRConnection,DSRCounter,ThreadName,Unknown4,Unknown5,Text | 
A restart of the PowerConnect agent can be completed using the instructions in the following document: Start & Stop PowerConnect Java agent (PowerConnect Java - All Versions) .
Splunk Event
Default Trace Log
The event will look like this in Splunk:

Application Log
The event will look like this in Splunk:

Configuration Changes Log
The event will look like this in Splunk:

Security Log
The event will look like this in Splunk:

Security Audit Log
The event will look like this in Splunk:

