Auditing or audit logging is a feature
of the SAP HANA database that
allows you to see who did what in the
database or try to do what, where and
when. While auditing doesn't increase
your system security as such, if wisely
designed it can help you achieve greater
security by recording critical system
events. For example changes to user
authorizations and roll definitions,
failed logon attempts, changes to
database configuration, access to
critical data including both read and
write access logging or the actions of
highly privileged users. Auditing in SAP
HANA is policy based. An audit policy
specifies which actions should be
audited. An action corresponds to the
execution of an operation in the
database by SQL statement. For example
you want to track the creation of new
users in your system so you create an
audit policy that audits the execution
of the SQL statement create user. You can
include several actions in a single
policy and the general recommendation is
to create as few policies as possible
but not all actions can be combined
together. Generally only related actions
can be combined in a policy. If necessary
you can define audit actions in more
detail. For example you don't want to
track access to all tables just those
containing certain critical data or you
don't need to track the actions of all
users just the system administrator. A
policy that tracks all actions of a
single user is called a firefighter
policy. While you are responsible for
creating the audit policies that are
needed in your system there are some
actions that SAP HANA always logs if
auditing is active in the system. These
are mostly related to changes in the
auditing configuration itself. For
example someone dropping a particular
audit policy or clearing the audit log.
When an action in a policy occurs an
audit event is written to the audit
trail. The severity of an audit event
emergency, critical or info for example is
configured in the audit policy. The audit
trail can be written to two locations in
production systems. Either the syslog of
the operating system or an internal
database table. The syslog provides a
high degree of flexibility and security
and can be integrated into a wider
system landscape. However you must ensure
that it is properly configured and that
it's accessible as a target. The internal
database table is also a secure and
tamper-proof storage location for audit
entries and auditing information can be
accessed and analyzed quickly. To be able
to view this table a user need system
privilege audit operator or audit admin.
You can configure and combine multiple
audit trails. For example you could
configure all audit entries to be
written to the database table but
critical entries be written to syslog as
well. The audit trail can also be
configured individually for each policy.
Auditing is disabled by default in SAP
HANA. Using the auditing app of the SAP
HANA Cockpit you can enable auditing,
configure audit trails and create and
manage your audit policies.
For more information about auditing in
SAP HANA see the SAP HANA security guide on
SAP Help portal at help.sap.com
forward slash HANA underscore platform.