Skip to main content
Skip table of contents

SAP S/4 HANA Cloud - Public Edition Audit Logs

Overview

The SAP S/4HANA Cloud – Public Edition Audit Log Input collects system audit events from the SAP Audit Log Service, providing visibility into security-relevant activities across your cloud tenant. These logs capture authentication attempts, user activity, and internal system events, supporting security monitoring, forensic analysis, and compliance reporting.

This input is particularly valuable for tracking user logons, identifying support or system access, and correlating activity across time, systems, and users. By normalizing and enriching the logs, the data becomes ready for integration with the target SIEM or observability platform.

Data Collected

Field

Description

event_id

Audit event type (e.g. "AU1" for user logon activity).

log_tstmp

Timestamp of the event (in UTC).

slgmand

Client ID (Mandant) within the SAP system.

sid

System ID of the S/4HANA Cloud tenant.

counter

Internal counter (typically 0 for single-entry events).

terminal_name

Terminal name or IP address where the event originated.

user_fullname

Full name of the user performing the action (may include service user descriptions).

user_Id

Unique ID of the user.

user_alias

Alternate user alias, if available.

email_adress

User's email address (if provided in the audit log source).

user_description

Additional user information, often used for service accounts or support roles.

param_a to param_d

Parameters related to the action, often indicating logon type, method, or client context.

slgrepna

Program or transaction name that triggered the event (e.g., RSBTCRTE, SAPMHTTP).

slgtc

Transaction code or log group classification, if available.

rsau_text

Human-readable description of the event (e.g., “Logon successful (type = B, method = A)”).

Configuration

Importing the Client Certificate

  • Login to the PowerConnect Cloud web UI

  • Click on the Configuration tab

  • Click Certificates then Import Certificate

image-20250325-040118.png
  • Enter an alias name then click Choose file and upload the client certificate file

    image-20250325-040224.png
  • Click Import

  • The certificate is now imported and ready to use

Adding an Audit Log Input to PowerConnect Cloud

  • Login to the PowerConnect Cloud web UI

  • Click on the Inputs link in the menu bar

  • Click the + button to add a new Input

  • Under Platform choose S/4HANA Cloud Public Edition

    image-20250325-035257.png
  • Then choose audit-log

    image-20250325-035335.png
  • Fill in the details previously obtained from creating the API user

    image-20250325-035949.png
  • Choose the output for the target platform

  • The input is now created

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.