The SM69 event is used to determine and log all the Operating System commands maintained in the SAP system’s SM69 transaction.
Potential Use Cases
This event could be used in the following scenarios:
Determine which Operating system commands are maintained/changed in the SAP system/s and who maintained those commands.
Monitor to determine if critical Operating System commands are added/changed and/or attributes are being changed
Identify and alert on Operating System commands maintained, which could create compliance concerns
Out of the Box, only delta OS Commands are extracted that are changed within the execution time range. However, snapshots of all the OS commands can be extracted as well for which the below configuration needs to be done for the Metric in Metric configuration. To do this, log into the managed system and execute the /n/BNWVS/MAIN transaction. Then, go to Administrator → Setup Metric → Metric Configuration.
Set ‘Parameter Value' as ‘X’ for the Parameter Key 'SNAPSHOT’ for SM69.
The event will look like this in Splunk:
Log in to the SAP system and execute the transaction SM69 to display the 'External Operating System Commands” list.